Resubmissions

08/11/2026, 18:04

261108-wnpg1ssxfy10

04/11/2026, 20:03

261104-ys2n9aef2610

04/11/2026, 19:58

261104-ypys7at1fx10

03/11/2026, 23:23

261103-3c93xawzfw10

02/11/2026, 19:19

261102-x1t4psgb6810

31/10/2026, 07:12

261031-h1hy4sws9p10

29/10/2026, 02:23

261029-cvg7qswt3k10

29/10/2026, 02:16

261029-cqhmpshx4p10

29/10/2026, 02:15

261029-cpk2faws9j10

27/10/2026, 15:58

261027-tey9ravwhs10

Analysis

  • user interaction
    yes
  • max time kernel
    10s
  • max time network
    31s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/11/2026, 20:03

General

  • Target
    https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
  • Sample261104-ys2n9aef26

Malware Config

Extracted

Path
  • C:\!Please Read Me!.txt

  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �
Wallets
  • 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 43 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/raw/refs/heads/master/Ransomware/WannaCry.exe
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xb8,0x104,0x7ff88092c728,0x7ff88092c734,0x7ff88092c740
      2⤵
        PID:4780
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1708,i,16151268447314535611,8891745577576032336,262144 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2008 /prefetch:2
        2⤵
          PID:4552
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2288,i,9447419320141887061,9458046091460548019,524288 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2332 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • System Time Discovery
          PID:4112
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,8312047981011529814,16092646523933497109,524288 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2428 /prefetch:8
          2⤵
            PID:1376
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,14536907179173526374,827580230094264965,2097152 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
            2⤵
              PID:3884
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,14519485506080208806,8108295113144717149,2097152 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
              2⤵
                PID:1428
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,12435816029082587771,13632014859476790718,524288 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5288 /prefetch:8
                2⤵
                  PID:4540
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,5679077595890152418,5399065809429726778,524288 --field-trial-handle=2012,i,11160836816590070580,2334045374535221771,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5380 /prefetch:8
                  2⤵
                    PID:2408
                  • C:\Users\Admin\Downloads\WannaCry.exe
                    "C:\Users\Admin\Downloads\WannaCry.exe"
                    2⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2904
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c 149911793822642.bat
                      3⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2972
                      • C:\Windows\SysWOW64\cscript.exe
                        cscript //nologo c.vbs
                        4⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:3256
                    • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe f
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2984
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im MSExchange*
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2316
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im Microsoft.Exchange.*
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5032
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im sqlserver.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4432
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im sqlwriter.exe
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2988
                    • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                      !WannaDecryptor!.exe c
                      3⤵
                        PID:8404
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c start /b !WannaDecryptor!.exe v
                        3⤵
                        • Executes a command shell one-liner
                        PID:8420
                        • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe v
                          4⤵
                            PID:8704
                        • C:\Users\Admin\Downloads\!WannaDecryptor!.exe
                          !WannaDecryptor!.exe
                          3⤵
                            PID:8436
                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                        1⤵
                          PID:1172
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:3628
                          • C:\Users\Admin\Downloads\WannaCry.exe
                            "C:\Users\Admin\Downloads\WannaCry.exe" /r
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:4648

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                !Please Read Me!.txt

                                • Path C:\!Please Read Me!.txt
                                • Size 797B
                                • SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
                                • MD5 SHA1 SHA512 TLSH

                                OfficeIntegrator.ps1.WCRY

                                • Path C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WCRY
                                • Size 5KB
                                • SHA256 3f01a0936748ff17a2ddef1374fd57e1f4012bbce003e1f79ff01d5b46a4ebfe
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                stream.x64.en-us.db.WCRY

                                • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\891EC729-218E-447D-AE84-A86C11996DAD\en-us.16\stream.x64.en-us.db.WCRY
                                • Size 438KB
                                • SHA256 a63ea1befc15658001f2c7db68187e4449da32a1c11d833c5ff2c4088d77ff78
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                stream.x64.x-none.db.WCRY

                                • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\891EC729-218E-447D-AE84-A86C11996DAD\x-none.16\stream.x64.x-none.db.WCRY
                                • Size 1.8MB
                                • SHA256 aeb13d30554df47534d6e2907c9d426dab1e2253963a79f4c6dab8bd22bed81f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                background.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WCRY
                                • Size 126KB
                                • SHA256 adfbff7710cfb514bf2d946e9c1025728eafb9d59c75f9e691c6c00bcf7023ce
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                device.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WCRY
                                • Size 43KB
                                • SHA256 e54d68107f4df1b3a4fe8f1883749d745d6600de3c374155cce1e1ebe700133d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                overlay.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WCRY
                                • Size 28KB
                                • SHA256 8df735a2a213f143a9a625f9fe6de3b37cd7b78ca668e8b8365f0b433af9dae0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                superbar.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WCRY
                                • Size 38KB
                                • SHA256 0131dc1fd63637c941ce2511f6430366cc34e2285af8a84fea5bfd88ade0470d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                background.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WCRY
                                • Size 126KB
                                • SHA256 809b5fdc4e9680177bf240951509d530b1eb28ef71c780e4d0f46e38c6d8b639
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                watermark.png.WCRY

                                • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WCRY
                                • Size 28KB
                                • SHA256 8287b0dac138c8783a88facbcfcffaa7ad6cfa747e7ded13d30471f53f6f6f2d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EventStore.db.WCRY

                                • Path C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WCRY
                                • Size 56KB
                                • SHA256 23e45e1c19ea24dcd886cabd241be04cebb8b28feedb6e77dec81afc503d34d4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EventStore.db.WCRY

                                • Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WCRY
                                • Size 32KB
                                • SHA256 cef23bf3fab11f78a59b6dd5eed52bec72bb6825dcad6d227435871a083ef9bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EventStore.db.WCRY

                                • Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WCRY
                                • Size 20KB
                                • SHA256 1d0af0177aa67de622253ab3621c3fa2b86c08ffd6a577e59b4a98cb3647a4de
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                osver.txt.WCRY

                                • Path C:\ProgramData\Microsoft\Diagnosis\osver.txt.WCRY
                                • Size 296B
                                • SHA256 d40d18829332756a35388b07672e0d3f841f218a30a4dce55823f12cdd9bbd62
                                • MD5 SHA1 SHA512 TLSH

                                qmgr.db.WCRY

                                • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WCRY
                                • Size 768KB
                                • SHA256 703df8f26d6ed5888ca295402a9a6295ca1de35ba36ad80ed5e749ae92f47204
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Windows.edb.WCRY

                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WCRY
                                • Size 8.0MB
                                • SHA256 b48a00edd0b829aa36a62711b538267ae1761de4091119de9297499b344ff4f2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SmsInterceptStore.db.WCRY

                                • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WCRY
                                • Size 192KB
                                • SHA256 9cf59759fe8651bdb7bd7fefd3b72ccc63954791dea719db59f3c7a3903123d8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterInboxTemplates.ps1.WCRY

                                • Path C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WCRY
                                • Size 904B
                                • SHA256 2cd63541b77d438eed350d5498d2d87807eabd41be881eb0cbbb1831e78f3e23
                                • MD5 SHA1 SHA512 TLSH

                                guest.bmp.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WCRY
                                • Size 588KB
                                • SHA256 a6529a782f2d0e198f924db7034676469831c7df5e424cfebe023dedb402b8fe
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                guest.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\guest.png.WCRY
                                • Size 6KB
                                • SHA256 06f01f69236f354e530aad691bfdcc5057c066f44da16c74da7b7010f4250101
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                user-192.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WCRY
                                • Size 2KB
                                • SHA256 29c25b93bb30cce4056bb30fc893a1c264dc325b8be9c0b82b6f78170f3c6562
                                • MD5 SHA1 SHA512 TLSH

                                user-32.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WCRY
                                • Size 728B
                                • SHA256 5f01b733804c3ce38f44bf95fcb737b170b886a0d0c24aa499bef48a669799b7
                                • MD5 SHA1 SHA512 TLSH

                                user-40.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WCRY
                                • Size 808B
                                • SHA256 c91bc6136dd6aeeaa1066e43b035d1a9ad95b163348209a205c5dc3fc4094f2e
                                • MD5 SHA1 SHA512 TLSH

                                user-48.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WCRY
                                • Size 904B
                                • SHA256 92bd933ee04978d002ac8b683f69f30979bc051092efa2369b93ba34a51f86a4
                                • MD5 SHA1 SHA512 TLSH

                                user.bmp.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WCRY
                                • Size 588KB
                                • SHA256 6a0b85fa20308dc4a18d28d802353878e857bdf8857df255b31e1d569ee9467f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                user.png.WCRY

                                • Path C:\ProgramData\Microsoft\User Account Pictures\user.png.WCRY
                                • Size 6KB
                                • SHA256 4fc027b65d11d14bb86510177a36589b869180682a079012551fafd19c2ea871
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\de-DE\WelcomeFax.tif.WCRY
                                • Size 99KB
                                • SHA256 f1fdde446438fe11b62f89ccb311dd7014e329ee07a07899454d84e91f320676
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WCRY
                                • Size 87KB
                                • SHA256 abc2118f0398bec3b0cddb8eabf13792065bd1489fb447e35d033136cf6914b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\es-ES\WelcomeFax.tif.WCRY
                                • Size 94KB
                                • SHA256 3dca5805be0e46c319ca584c2eb95397c080f0a14e133c70022d197485cf9411
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\fr-FR\WelcomeFax.tif.WCRY
                                • Size 101KB
                                • SHA256 c451d52f0662b90c389bee7d32f7925274b1653a1206aef862f29eb4d5a1e670
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\it-IT\WelcomeFax.tif.WCRY
                                • Size 92KB
                                • SHA256 f27beb96ed7aa854b3ae14b8ed4cec1ef2daef6c730e5c03faeba97605da6fad
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\ja-JP\WelcomeFax.tif.WCRY
                                • Size 77KB
                                • SHA256 2b232127827c8d099dbea0c447777d8d5f4a06c81ac1a4c880862dd9fa8ee01e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeFax.tif.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\uk-UA\WelcomeFax.tif.WCRY
                                • Size 105KB
                                • SHA256 be3e6858efad2776839cc5f4b61128b305f26736f04640d8f7e88f083bb5538a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WelcomeScan.jpg.WCRY

                                • Path C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WCRY
                                • Size 504KB
                                • SHA256 a177bfac0605e62e02e7094c02faf590b072f36eb09c1c914efd6a5e43c54b79
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                cversions.2.db.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WCRY
                                • Size 16KB
                                • SHA256 fe6fe2ce96867c8d909206f292a17ae039fbfbb7269064f3a30f614e3fa1be74
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {69113806-57EB-4454-8E6C-9C7568B183D0}.2.ver0x0000000000000001.db.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\Caches\{69113806-57EB-4454-8E6C-9C7568B183D0}.2.ver0x0000000000000001.db.WCRY
                                • Size 1KB
                                • SHA256 3ce7261a0f535fbfdcd929ef835bd68dfee66c805c9724091dd21b7bf4529561
                                • MD5 SHA1 SHA512 TLSH

                                {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WCRY
                                • Size 289KB
                                • SHA256 5f7d38e0c19b99ddb3fab53038081c3ed66e6049755308a2152e4265a9ae6484
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WCRY
                                • Size 289KB
                                • SHA256 6082c9eea5fa651e1c794f307c5e1516180b2e65536ba8a51b678d3749040832
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WCRY
                                • Size 623KB
                                • SHA256 b158f079d456fcb38f8c39b572a1f89b0c414893c2f4a4f75f908bfc209179c5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                tokens.dat.bak.WCRY

                                • Path C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.bak.WCRY
                                • Size 603KB
                                • SHA256 d63282758b09c7e406e1efbac04463eadf9a9144231b8f43c1ba6afcca4b7b34
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ActivitiesCache.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db.WCRY
                                • Size 1.0MB
                                • SHA256 146a607643ea5accaf173ab44286953f6e8b2bb871e62e63b46aa6a9106f9b93
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                settings.dat

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                • Size 40B
                                • SHA256 a6249f26f37b42a8aab1c42bcd8d2d1ed0465e9642dfcd70d03e3935cdfab2ce
                                • MD5 SHA1 SHA512

                                24b27286-0320-402a-9aa5-ba6746b74ef6.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\24b27286-0320-402a-9aa5-ba6746b74ef6.tmp
                                • Size 414B
                                • SHA256 61966ed214abdaac47c5b2437210c031b470422216b910964e7da399c37f6f73
                                • MD5 SHA1 SHA512 TLSH

                                397ea83f-8f7c-4dd0-a80c-7c82cecc89dd.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\397ea83f-8f7c-4dd0-a80c-7c82cecc89dd.tmp
                                • Size 11KB
                                • SHA256 0a82988d47ff73aaa20940e9817dddfbb7bf256efba0c61434ec8e54ac58d960
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                data_1

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnWebGPUCache\data_1
                                • Size 264KB
                                • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                • MD5 SHA1 SHA512 SSDEEP

                                6c3fd8e9-2f24-4a43-8e8a-1434f6d43b42.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6c3fd8e9-2f24-4a43-8e8a-1434f6d43b42.tmp
                                • Size 1KB
                                • SHA256 2b6e1d120d34bf551a3eead86c91a2352c529571bea74841505de4c48d3829d5
                                • MD5 SHA1 SHA512 TLSH

                                7b45beef-20da-4c8d-b960-48e385ea4726.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7b45beef-20da-4c8d-b960-48e385ea4726.tmp
                                • Size 858B
                                • SHA256 e6a78ea7bc9d9116dcab57764aaf918135719b1d4ed22ec9bda9e6e5843498e8
                                • MD5 SHA1 SHA512 TLSH

                                b2b4a92d-40f9-4338-add9-fc392675feb0.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\b2b4a92d-40f9-4338-add9-fc392675feb0.tmp
                                • Size 2B
                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                • MD5 SHA1 SHA512

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WCRY
                                • Size 8KB
                                • SHA256 070f67fb32d67e3b6143d6007a2fbaa517591b00c5b8544314d5f7b50d4b8909
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WCRY
                                • Size 5KB
                                • SHA256 024c8452c05a7e824cc92d10a6f2b00b291658a97ea73b77c08d992b7e480aff
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WCRY
                                • Size 20KB
                                • SHA256 6daaebe3f19e0c13977b2e86422b6a1e89bfd3c1a1624b2f680c0454d5073b64
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WCRY
                                • Size 2KB
                                • SHA256 1c95c4f413f949076fe3f2124f476f06663b7856f73ef496553b662eae4ca5e3
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WCRY
                                • Size 3KB
                                • SHA256 21ea322f9a5187f24ebe79db556e996c7541c719769bf40710afbcf5b14c2216
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WCRY
                                • Size 4KB
                                • SHA256 e46b773a94dcf40472ae885c905be9393f1370e9a791780f196aa35c42c8ae2a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WCRY
                                • Size 6KB
                                • SHA256 7a0bfb7c8433951a24ee91d17a50caa9ed63de2ed033248af3d37122b20a7ce0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WCRY
                                • Size 10KB
                                • SHA256 07c0abb5084865ce0251ca4372e030da8bc8c2131f65ab62b872f2fa07609210
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WCRY
                                • Size 7KB
                                • SHA256 26fb7619f61a1ff5e4dfea6ab8dc795b25fa853b81ac2707d55ab7af0fc67733
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WCRY
                                • Size 26KB
                                • SHA256 746e7a2696aeab64e7fb25b9972d9031a9a784d9e6f60eae5438ea38b7fb7a9f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 05e5e60d954efc7647e2a31ada3a7b8a7eebe0577ef0b8dd55858620daeb4490
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WCRY
                                • Size 2KB
                                • SHA256 fdb0d48bf10622400047cd10770e7b5a96879afcc4b0b524aa20c8d4c8173ee1
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WCRY
                                • Size 4KB
                                • SHA256 d67347f009225eecb3efabb99dae4b8191943610ba3f3720839a982af7860abd
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WCRY
                                • Size 7KB
                                • SHA256 59d178400839d5faeaa614de18f8494732fe50ac0ca44ae88f368bb0c6d9e2b0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WCRY
                                • Size 2KB
                                • SHA256 493755cf2fd1f8b112e55da9e9dae63b3227c23a3dccee43e36b0eeb212ed872
                                • MD5 SHA1 SHA512 TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WCRY
                                • Size 1KB
                                • SHA256 743ac2b36242dfbe3219504db468b7717541b389235b6fd8301f4fc452b0b1ed
                                • MD5 SHA1 SHA512 TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WCRY
                                • Size 5KB
                                • SHA256 5a998e0326fbc85583c6da8413472b7e0dc8a904349393de996d9cc00fd9dd55
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 549f433daa05c38c16f9112930bb18e03dc5b2d49a2f32d38005042c0f0e2992
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WCRY
                                • Size 1KB
                                • SHA256 8ce7c3bab52033f63a63dcc9f98012a4c49161f4e70385424baa66aa6bca561b
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WCRY
                                • Size 1KB
                                • SHA256 10e687df9b8a5082b161c9d2f593f3d4181b1cda3a230ae12f2aaace1420afda
                                • MD5 SHA1 SHA512 TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WCRY
                                • Size 2KB
                                • SHA256 09493684b1db627261eefe3e037c9100d072b43155473692dd15e8e284b94857
                                • MD5 SHA1 SHA512 TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WCRY
                                • Size 5KB
                                • SHA256 8ab916930564de8bc454fe4df4d8cd059f12cd58de736d9ec57c9f3da7a35f36
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WCRY
                                • Size 3KB
                                • SHA256 fa7b249ec906d969232c9388bcb756090c02d8ac70c86c26a63da27db5c44989
                                • MD5 SHA1 SHA512 TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WCRY
                                • Size 13KB
                                • SHA256 9c1fae3044edc1baff97f58fcb1cd482ca8e794c9bbc004d554b0b65076b32e1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 9143e97aa0712d92958f808a60c71ce4fca8a04c30dd4cfaf98479b2b29d4e28
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WCRY
                                • Size 2KB
                                • SHA256 221bb3a46a5ddee9b427f6cb23eef2137ae5faeb840cd06b2bacddb7a65aa2ff
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WCRY
                                • Size 3KB
                                • SHA256 076bc6cecb8bc0a0db3c3af6fc400d4330fbbe71c1dab52ab60b52e1f6889ce5
                                • MD5 SHA1 SHA512 TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WCRY
                                • Size 4KB
                                • SHA256 601f309b508ac4f0e964d5bd113056875b0c99ba07687a9c1604aaf95d9bc11f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WCRY
                                • Size 2KB
                                • SHA256 733504d55cb2627a944da352744f790a2866c7d545f9e97de6d2af2833fff1be
                                • MD5 SHA1 SHA512 TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WCRY
                                • Size 1KB
                                • SHA256 68614826234db4dac52fe6e7c00c15dd7d24ade7909604fc555a8c51f4af3f65
                                • MD5 SHA1 SHA512 TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WCRY
                                • Size 4KB
                                • SHA256 947fde0cf93e82733532806fd0a42b9c9289ef9a417dd6fbda340397d85be067
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 3fd0474cc26cdaa304f8e3b34063017bfa94b2534368d918699d7b1efe63896f
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WCRY
                                • Size 1KB
                                • SHA256 b2369ffa49386dd9252557ae02863646fc2258988fc4936e0581f2d0c5d7761d
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WCRY
                                • Size 1KB
                                • SHA256 686cbc3e17663af13de348007ecb72f42361c62865a87c67ef32c1278773a0d7
                                • MD5 SHA1 SHA512 TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WCRY
                                • Size 1KB
                                • SHA256 f7bce16836a5ea19ef72cf8f9b00865eba17a82751aae0b5fca75dcf7f4bf7a3
                                • MD5 SHA1 SHA512 TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\128.png.WCRY
                                • Size 3KB
                                • SHA256 8da545c49c2100011e40e76ae308b06f21a0a595460381a81a733b038d868544
                                • MD5 SHA1 SHA512 TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\192.png.WCRY
                                • Size 2KB
                                • SHA256 ce4bd5a1853568d1b12951f6a35f593729ff790ca0f2b2a58b10a067f7926ecd
                                • MD5 SHA1 SHA512 TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\256.png.WCRY
                                • Size 6KB
                                • SHA256 1995f87d62cdcd0d1a2f89b8ab3a41e96fe52251bf33f2bf5cb345ded1ab61c6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 5569436379e9f11e8191f6736d00186c5aab7f039e77cf194a1387bc250af530
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png.WCRY
                                • Size 2KB
                                • SHA256 58d48ade28c2273b54a1a8cc499cb69fbd1ad249ef438e7b80a8e229b22563f8
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png.WCRY
                                • Size 2KB
                                • SHA256 eddaba60839ab2393ce2e0681da54e59229c9e0299807e33a5f1862bbca7cf96
                                • MD5 SHA1 SHA512 TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\96.png.WCRY
                                • Size 2KB
                                • SHA256 232a33a46723e2f71fdc1dbc1fc85792ea2886ef7f3ca8643ab7a792300c1e36
                                • MD5 SHA1 SHA512 TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WCRY
                                • Size 2KB
                                • SHA256 2344d81abc7e0195b969b54c65971394571b62617b1ed1d87fb75da8d557d8f2
                                • MD5 SHA1 SHA512 TLSH

                                192.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WCRY
                                • Size 1KB
                                • SHA256 bdc10b45897759c7b98ac0cda4bf2c3990c87669c7288cf8c63afabbb3a48192
                                • MD5 SHA1 SHA512 TLSH

                                256.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WCRY
                                • Size 4KB
                                • SHA256 11d0d6d08b6a044bdd90d5988711b46e3c2c6a3993089330b184113c87c461b7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                32.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WCRY
                                • Size 1KB
                                • SHA256 e419f9a1961d7a31797a129bd2e44c508efc1df68634d2498e8461576191427f
                                • MD5 SHA1 SHA512 TLSH

                                48.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WCRY
                                • Size 1KB
                                • SHA256 666101700074323c2e356c51c71324425842d534160ecb5368b3b2e27b1c4847
                                • MD5 SHA1 SHA512 TLSH

                                64.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WCRY
                                • Size 1KB
                                • SHA256 038ab90d2590233d1da22f1e1620291137cffe7905d21728a3caf22c27aab0e4
                                • MD5 SHA1 SHA512 TLSH

                                96.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WCRY
                                • Size 1KB
                                • SHA256 60201e142dd36d529a2670fa9461ab573fd9c2e6a46c661cfa27b7cf83b99113
                                • MD5 SHA1 SHA512 TLSH

                                bc3f504b-6ef2-4ddc-8467-b91c380474d1.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bc3f504b-6ef2-4ddc-8467-b91c380474d1.tmp
                                • Size 11KB
                                • SHA256 69de6dc15114076d475e4d2dcbd4f54f468751981803dff78752531ab5ac90ad
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ecacb8f1-f191-4af7-9dd6-f9f01a8750d0.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ecacb8f1-f191-4af7-9dd6-f9f01a8750d0.tmp
                                • Size 6B
                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                • MD5 SHA1 SHA512

                                heavy_ad_intervention_opt_out.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WCRY
                                • Size 16KB
                                • SHA256 d2823b86972305c1e42cd3802010c89c8bdac521d2c62031ccb4ab1876eea143
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                c674e372-1614-4401-ae7b-7af64f9868ab.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c674e372-1614-4401-ae7b-7af64f9868ab.tmp
                                • Size 130KB
                                • SHA256 927f38c96fba527e3c6d1e62487994d2ee549b78c7cfad30f4a35a6fc186c0f4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                f4d852ba-4544-43a7-b15d-dd07f41635cd.tmp

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f4d852ba-4544-43a7-b15d-dd07f41635cd.tmp
                                • Size 131KB
                                • SHA256 d6b3ce25e16a0114278b2ec5bf43c8e5f926196c25cd3a0c9afba049fbdd0690
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                first_party_sets.db

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
                                • Size 48KB
                                • SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                first_party_sets.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WCRY
                                • Size 48KB
                                • SHA256 843eb151161ee58724f5b872a7c1b0c57598286278bca471625b8d99bfba807f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                IconCache.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\IconCache.db.WCRY
                                • Size 11KB
                                • SHA256 d38cbc6afeca3f820cbb310c05d96f402b6812caa3e253df63a9c3621d3e81b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EdgeEDropSQLite.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WCRY
                                • Size 32KB
                                • SHA256 eba866fae5cb46afe51c25da85935ce79a74fa9c0fdf6ce199be006ef142d6a8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EdgeHubAppUsageSQLite.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WCRY
                                • Size 32KB
                                • SHA256 4d19e7a12bd0c0872d13cdd641a96a7e76fef06c3f0434cf9b36c8bba528b0bd
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                index.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.WCRY
                                • Size 664B
                                • SHA256 b54f4bee1e9b3687e330913fdf8aba27f5c255ed3882f452a1b232bd98466005
                                • MD5 SHA1 SHA512 TLSH

                                heavy_ad_intervention_opt_out.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WCRY
                                • Size 16KB
                                • SHA256 e84b87c25ddbaeeb73bd5a20935be5ce2be05796fb58b6747364e76979aa44df
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                load_statistics.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WCRY
                                • Size 84KB
                                • SHA256 7879fecd7e95c27121c03604200f9e5e8207dec29e23f8d4389f0bef55f6f9f3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                first_party_sets.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db.WCRY
                                • Size 48KB
                                • SHA256 02cd288d666eadb580fd0ead4ae6f723cb7fc97861cc96da204f6f3de532f871
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                mip.policies.sqlite3.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\mip.policies.sqlite3.WCRY
                                • Size 36KB
                                • SHA256 d1b0b777183a0c0b5a23b51afc71da3f5ab65ef41b91a3626d6936267feb944a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                excel.exe.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WCRY
                                • Size 24KB
                                • SHA256 c66e0729739faa8f9b6f597dcc7149132ff7e01b01afe92e090ba065ef86e582
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                officeclicktorun.exe.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WCRY
                                • Size 24KB
                                • SHA256 1cf91909854166a5f26d2148fdafd792c42f7fcdad75b4de4c9a2560bc816954
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                onenote.exe.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db.WCRY
                                • Size 24KB
                                • SHA256 21803456a886f2e6cdd0e9e116aaf7b6ca450eedb10336740a98dd45bf7443f0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                outlook.exe.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\outlook.exe.db.WCRY
                                • Size 4KB
                                • SHA256 c36794cc42a4aafc10dfa4c28e2489def6030d7e31a63265d69a40945fbef2b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                winword.exe.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WCRY
                                • Size 24KB
                                • SHA256 ce1eb28656211e3c5135d4d568e2ae6e6437e256861ef339a8be97bac54e5ee2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppBlue.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.WCRY
                                • Size 5KB
                                • SHA256 c229fb8c5642179adedfa5f9ef73f4fdbb4799f1764cdfd69f17c9c6fb5e7a14
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppErrorBlue.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.WCRY
                                • Size 7KB
                                • SHA256 ee698f29a4a3aa409daea7c6a27ffde4c5b9979b9ea386b24de70c77913c5fba
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppErrorWhite.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.WCRY
                                • Size 8KB
                                • SHA256 fe798b211cb0827bdb237378f6443c45856228c7f89d03829cdf043bbd172ace
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppWhite.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.WCRY
                                • Size 3KB
                                • SHA256 0d30a32aa363292337d12e01448328b1b492bb4bc1269f40f8d569ebc5328cfb
                                • MD5 SHA1 SHA512 TLSH

                                AutoPlayOptIn.gif.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.WCRY
                                • Size 374KB
                                • SHA256 e806067dae5d57b7a1aae7f874407d8f81b5a4b85891d3ec3225c66e00777f7e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AutoPlayOptIn.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.WCRY
                                • Size 10KB
                                • SHA256 aed79e208932b2289ed67013409ccd1de322e35a61eb5d67b6578502fb10913e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CollectSyncLogs.bat.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\CollectSyncLogs.bat.WCRY
                                • Size 6KB
                                • SHA256 4fb9df9e3f7e79e998a26bc4e310757bb2a937ae24e9e58a8bc9f6d0956b6893
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ElevatedAppBlue.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.WCRY
                                • Size 7KB
                                • SHA256 878a3e2aafd13fd899f55e4784b6edf3ae029f5949ebcaee4a4bdfd2c341dffb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ElevatedAppWhite.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.WCRY
                                • Size 5KB
                                • SHA256 e79895f269ec5bd0ada5b48cffd237281d024203a79599b056530582ff0fc2ca
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Error.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.WCRY
                                • Size 7KB
                                • SHA256 9c2644e83abadaba7c2d4e729d8fff06db7de2bebf99b2a8e5813e1d2119700b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                KFMHeroToast.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.WCRY
                                • Size 15KB
                                • SHA256 c8b99ae4f2ba51cef980ad8a67fa93ae6ca5cd6b57fa39a8f923e4cb1996a83a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                KFMLockedFileToast.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.WCRY
                                • Size 10KB
                                • SHA256 df300232f1119837a7c9232dacc3a4b71950e02c6621ec31a3dac813e0bba902
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                KFMScanExclusionToast.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.WCRY
                                • Size 10KB
                                • SHA256 c71d2beb2da19703f811ff18f8d3a1a86e30e9aae7367d6ec80118f61610d68e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OneDriveLogo.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.WCRY
                                • Size 4KB
                                • SHA256 dabb780355d8a5fe83b89a20438194611fa6570e3633b6e2d8a86da92c288b03
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                QuotaCritical.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.WCRY
                                • Size 8KB
                                • SHA256 d77d3b20efe8540e05ebe1cb200c0e0ac749ed600a498d92fca5e84c4f93c5dd
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                QuotaError.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.WCRY
                                • Size 9KB
                                • SHA256 584d829235f898ee5fcb1e2e582d954b64ee27322061002ec81f32b02fef99f3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                QuotaNearing.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.WCRY
                                • Size 7KB
                                • SHA256 d9bf71549a3f29188a6735c188d0acbd9fce28feaa2dd926e4fe21c51be78ce7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ScreenshotOptIn.gif.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.WCRY
                                • Size 238KB
                                • SHA256 0788103b859b33374c6a015f574968b1450afbaa5458142563cda3c9db7ff7aa
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ThirdPartyNotices.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.WCRY
                                • Size 48KB
                                • SHA256 53c0b1d938b95384618d53cd2ddcd678af52dcf1c6f0dc6840824af95a181b25
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Warning.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.WCRY
                                • Size 2KB
                                • SHA256 1874c272a96e44b9c700144b37744a43e2c400837e8fbe969d5055f76a742116
                                • MD5 SHA1 SHA512 TLSH

                                alertIcon.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.WCRY
                                • Size 1000B
                                • SHA256 370b241501168a91d250335b2d7600c2c64ea308333f570a5f6e417a5a46312b
                                • MD5 SHA1 SHA512 TLSH

                                acmDismissIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\acmDismissIcon.svg.WCRY
                                • Size 2KB
                                • SHA256 8b47d6db2c8e409ba396291a5903c4d77df757df199d7cd32b8b1e90fcbb2d66
                                • MD5 SHA1 SHA512 TLSH

                                blurrect.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png.WCRY
                                • Size 1KB
                                • SHA256 58e3c3223d03382e4f4c3eaf7e5aa164ee9a3a6b66f77513878682a8bb18ea95
                                • MD5 SHA1 SHA512 TLSH

                                checkmark_finished.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_finished.svg.WCRY
                                • Size 504B
                                • SHA256 77ff628f9035b5aba04c850941c1d40a1f89491992f808de26a9f0b02511afaf
                                • MD5 SHA1 SHA512 TLSH

                                checkmark_hovered.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_hovered.svg.WCRY
                                • Size 680B
                                • SHA256 b647e4cd345b480a741c9ccd56fc2b9b4207ffc5628102413507a6b28c08592e
                                • MD5 SHA1 SHA512 TLSH

                                checkmark_in_progress.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_in_progress.svg.WCRY
                                • Size 680B
                                • SHA256 56298641b01ab8387160f1b4823d0fcfb7d56599db8fade155f2bd7f0f696dfe
                                • MD5 SHA1 SHA512 TLSH

                                checkmark_selected.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_selected.svg.WCRY
                                • Size 680B
                                • SHA256 04e26de7352467d2687480bc3e8bc6128221a427a44404e2f617a6101219678f
                                • MD5 SHA1 SHA512 TLSH

                                chevron.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg.WCRY
                                • Size 584B
                                • SHA256 cb907ecf104769ba10968b27d02cfe047e9f7a798b6dbd9ad4ae42c3192a551c
                                • MD5 SHA1 SHA512 TLSH

                                chevronUp.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevronUp.svg.WCRY
                                • Size 552B
                                • SHA256 762ca5ab204bcbde8d94a7beb72b4856f8ee76d004b9251628d817c4cfa60c4f
                                • MD5 SHA1 SHA512 TLSH

                                cloud.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\cloud.svg.WCRY
                                • Size 1KB
                                • SHA256 4fdaba9ea3dd29ae3c4fe8d7f2e6cfc4062ec85491b5b55e5810e1895c91789c
                                • MD5 SHA1 SHA512 TLSH

                                done_graphic.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\done_graphic.svg.WCRY
                                • Size 15KB
                                • SHA256 3dd26d07bc66ba605a53c89d5fa017fb26503362236cb17499443d6bb516499e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                errorIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\errorIcon.svg.WCRY
                                • Size 1KB
                                • SHA256 e5d1ebf92fe4e3e76c08776ba83543aea3d14c7f376d1ea97c773622c15ab988
                                • MD5 SHA1 SHA512 TLSH

                                folderIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folderIcon.svg.WCRY
                                • Size 1KB
                                • SHA256 fd50a056472f590185cdadc65239b9be993594e19372992a3d4a3d8dcf684eda
                                • MD5 SHA1 SHA512 TLSH

                                folder_image_desktop.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_desktop.svg.WCRY
                                • Size 2KB
                                • SHA256 71d3f5a4f357e88d9dee938038fec7cc684b1c1527569d5ee269e63748bbf756
                                • MD5 SHA1 SHA512 TLSH

                                folder_image_documents.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_documents.svg.WCRY
                                • Size 10KB
                                • SHA256 ad755da6ad1861a024bf0f2ca0b3b2bcc2f093cc74f22a0cfaad4837304ad986
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                folder_image_pictures.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_pictures.svg.WCRY
                                • Size 7KB
                                • SHA256 511847881bd64861f707ca5b418a1be3fbff230834942206a6af0a0445ba142f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                globeIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\globeIcon.svg.WCRY
                                • Size 2KB
                                • SHA256 40f0f81d56deafd406d7f3036018691bba36842e56c80668bafb0b3164e6a09a
                                • MD5 SHA1 SHA512 TLSH

                                iceBucket.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\iceBucket.svg.WCRY
                                • Size 6KB
                                • SHA256 409733aac4e23945a4bfe56551b6edfe78e43101b0eb6375c30173b4ffb143ec
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                infoIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\infoIcon.svg.WCRY
                                • Size 1KB
                                • SHA256 3a94d0074cb915cc1323d17e8cee7570bb659fa4c6cd4f9e8518550f58b41850
                                • MD5 SHA1 SHA512 TLSH

                                kfm_folders_image.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\kfm_folders_image.svg.WCRY
                                • Size 20KB
                                • SHA256 faef9a8a174563b5074029691cf41657ebaeec52917613f0b91ebd7f839c90be
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                loading.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading.svg.WCRY
                                • Size 1000B
                                • SHA256 babadbd7e3d1b3bbfcd88840d0068b1b5b9c72f9a18d97f993f8d7b01b183c1f
                                • MD5 SHA1 SHA512 TLSH

                                loading_spinner.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading_spinner.svg.WCRY
                                • Size 712B
                                • SHA256 469bc3e0d534fd643ba21b189ff14ccb9319b1e232c26368921d2c39d1916634
                                • MD5 SHA1 SHA512 TLSH

                                onDemandFiles.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFiles.svg.WCRY
                                • Size 7KB
                                • SHA256 c8513cbab02b2962f2e81e2ae2b3223b2c34d0cba1223e185d61c1560f1dd945
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                onDemandFilesDehydrate.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFilesDehydrate.svg.WCRY
                                • Size 9KB
                                • SHA256 4b99f1cc2e386e87c1a16d788d63b3479d1e0dd2f6cac9ef019f93581cbb13a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                onDemandSelectiveSync.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandSelectiveSync.svg.WCRY
                                • Size 2KB
                                • SHA256 2a065b97662a3e7f3f6424c1a4ee2b706526865f2886c7ee0e0559a7f7f3b61f
                                • MD5 SHA1 SHA512 TLSH

                                overflowIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIcon.svg.WCRY
                                • Size 1KB
                                • SHA256 dd39584fb4aad227ee30ffddf94568222b533b47cc93052424aec40bb4a15965
                                • MD5 SHA1 SHA512 TLSH

                                overflowIconLarge.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIconLarge.svg.WCRY
                                • Size 1KB
                                • SHA256 498ddc12ff77fd757d4ba36d6f817c6bf3d3f90a235fbe95a90e8bc977ab96fe
                                • MD5 SHA1 SHA512 TLSH

                                partiallyFreezing.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\partiallyFreezing.svg.WCRY
                                • Size 4KB
                                • SHA256 d047e29492c80786bc92a67f4d4ae2bff29bc75792bf0b8a4036c397f34a1aa8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                paused.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\paused.svg.WCRY
                                • Size 600B
                                • SHA256 c88420d57472b1e4e06d525d6cc6383b38ec91e939a19b5868e34be1461e90c5
                                • MD5 SHA1 SHA512 TLSH

                                premiumIcon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\premiumIcon.svg.WCRY
                                • Size 664B
                                • SHA256 448112ecf18f65434e8a8f8b022f4f48b1a94c95ba62fc064146d806f7ceac68
                                • MD5 SHA1 SHA512 TLSH

                                recycleBin.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\recycleBin.svg.WCRY
                                • Size 3KB
                                • SHA256 78438a03019e26c60845aacae4de3d3dba7df7fd12c579d191c9a0ab618ea0f0
                                • MD5 SHA1 SHA512 TLSH

                                shield_icon.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\shield_icon.svg.WCRY
                                • Size 1KB
                                • SHA256 0979ae7f89e9ae3149edba12abb679667842995835cb01e08feed7e5648c4394
                                • MD5 SHA1 SHA512 TLSH

                                signIn.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\signIn.svg.WCRY
                                • Size 10KB
                                • SHA256 bdd73a07e881ed5f318d704c77c337ffbc76f1df0d932b99ba5f93f4722ce517
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                stackedIceCubes.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\stackedIceCubes.svg.WCRY
                                • Size 4KB
                                • SHA256 ecf3608ad3e1e6e1e57823c460ee535e583ae8f69ee9ffa3d94ef986051ed35c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                warning-symbol_grey.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\warning-symbol_grey.svg.WCRY
                                • Size 536B
                                • SHA256 a26ec093349379f64e639be5fe0ddbb79be41ae1645f55f98c01514e0ae8936c
                                • MD5 SHA1 SHA512 TLSH

                                waterGlass.svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\waterGlass.svg.WCRY
                                • Size 2KB
                                • SHA256 04297b6149f52fb7c79d2d77d3a90a49eccf6b1962ed76b33d8e9f7aa97883c2
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-black_scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.WCRY
                                • Size 936B
                                • SHA256 bde3d6aca7b0cc7d2ec32307370e4ace753bbc30fce9b107c6a32288aefd5fec
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-black_scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.WCRY
                                • Size 1KB
                                • SHA256 c89b342631861ce723ab7a4254a72254f804d2d024af3e7ce6842a87437a4ade
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-black_scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.WCRY
                                • Size 1KB
                                • SHA256 34180f3d0bd4a053e0611f114e720d9f4943c9e5f3f6fcccf9383c231d8bdd18
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-black_scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 b18fde23d23dd42afd4a48a7bf36089eba671e28e800803cda3b9a444dd62f85
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-black_scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.WCRY
                                • Size 3KB
                                • SHA256 0be6a59666b680855c0cb2448b0892a8f763f020568dc2de1029a384d37ef42d
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-white_scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.WCRY
                                • Size 952B
                                • SHA256 f461d12cdd40faa6644351a4e69d8e41df7ab94ffed2accfc70cd4ed435d2e90
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-white_scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.WCRY
                                • Size 1KB
                                • SHA256 b7ff80ddfbde8a495b8e7782a7c92d7dd78d77c9a2312c15325742ad3eb0cc46
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-white_scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.WCRY
                                • Size 1KB
                                • SHA256 3abea09c150e0f293af1a6dfebc63fc5d73b71791f35901f6450d281cdbc0125
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-white_scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 42b8776902baff2d3b319812faf49f32985dc311878f1a33e8eee7591674eed5
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.contrast-white_scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.WCRY
                                • Size 3KB
                                • SHA256 88f9aeb416743a210a19ae0c35066875624c7a5d33e7e692b4c2f48de331b1a9
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.WCRY
                                • Size 936B
                                • SHA256 935eb97346f5d698a3ef6be0f69c076cd442d087c7172f24566e18f8cd27be23
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png.WCRY
                                • Size 1KB
                                • SHA256 8cc7c0ddae0a06a5ac7b62cc95e2cd6889c141741c3b60a31c8a8075d103b8de
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.WCRY
                                • Size 1KB
                                • SHA256 d103be237a4978d984f82a1088bba35714f08a9e7e4a41f04f01beaff7d92084
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 e7245dacc816cfbabb5529849be36e4e1403c7032300006d87070b715d1271c6
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveMedTile.scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.WCRY
                                • Size 3KB
                                • SHA256 075f1258db719fc2b547375bcb43faabc2cf0b36d474995030f020784583c2d1
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-black_scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.WCRY
                                • Size 696B
                                • SHA256 ac5a7df2533c4d4c443d73981bd0faa78746b544180bb0ff7686ed763e42ad48
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-black_scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.WCRY
                                • Size 808B
                                • SHA256 152aed409ef24e65a4b8856c16431fed8de26bd96b6de189a29ab0c1fc7e4803
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-black_scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.WCRY
                                • Size 872B
                                • SHA256 989ab9f18655c250cd05b664e1070518b466d06061283b8db691ee987d875bcc
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-black_scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 31ed41827c519496d863c03b1453065c7007018db74a3c4f40d7f698cbf38e3a
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-black_scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.WCRY
                                • Size 1KB
                                • SHA256 c792c27f15d7efd3c565a3235ec49fc497db3790a9d6816679b8aa5367612c64
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-white_scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.WCRY
                                • Size 696B
                                • SHA256 934c01d37cc8cf01679275d9c3b8603851e44e6b77199a04172065b862f05b54
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-white_scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.WCRY
                                • Size 824B
                                • SHA256 2686e0e736b85abd68002dd8accb48201f00d0da031cd717afd5d98d2e417615
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-white_scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png.WCRY
                                • Size 888B
                                • SHA256 f4d79b8179f5b52ba01667b95e9523e37d07e07e075300788e710fdcca7e8384
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-white_scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 33d239642a961a92169e5ee1145f46c79f46e6302beb8dcc975a6a89f3d6e126
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.contrast-white_scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.WCRY
                                • Size 2KB
                                • SHA256 b984b9e6b0e91a158d654c2a201b99824c47a37eb210cfdcb415fb9bd0b10a38
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.scale-100.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.WCRY
                                • Size 696B
                                • SHA256 b17b07834b2a954feeed5c791c7b88823baee4007c0dd748e3fd9396b7bebdc9
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.scale-125.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png.WCRY
                                • Size 808B
                                • SHA256 8c23c68ed4ad472a110cefa97c8ee5e29b01cbf49e900d477e6719a08784a9bb
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.scale-150.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.WCRY
                                • Size 872B
                                • SHA256 82aba88bc41512f7b421eadac8006e2049655681c8fc175775ab042146776935
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.scale-200.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png.WCRY
                                • Size 1KB
                                • SHA256 d4f9e0513664c9e584538e48b0df680fb42d30371de19ad82f5113f98fef727b
                                • MD5 SHA1 SHA512 TLSH

                                OneDriveSmallTile.scale-400.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.WCRY
                                • Size 1KB
                                • SHA256 795b7fe79cb32b55d2af20929aa253394e7ad76500c12eda193fdb24f31b617b
                                • MD5 SHA1 SHA512 TLSH

                                cversions.1.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WCRY
                                • Size 16KB
                                • SHA256 c0a6a78c2c464c8511464a9f7d679f0a398f8c6500c3735bb29b7eaa6c76a919
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                cversions.3.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WCRY
                                • Size 16KB
                                • SHA256 ed53e43e5d575d1e6fa9c793df9344a828ae80f7b796e35617162e3ccf18abda
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WCRY
                                • Size 414KB
                                • SHA256 2f73b707dbaae01187151d3d7fb3bb4c8ec2d33e85ac4ce3395efbb4845f8b6f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001f.db.WCRY
                                • Size 93KB
                                • SHA256 d15739ea69b572994e00eb686922b16367d9a9a610f860c281ee56f39dc3ebd6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WCRY
                                • Size 83KB
                                • SHA256 de331cc59c9d6e5d77d601c8a75bfe6937ef26c3e80c1a685082e7f346278c40
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db.WCRY
                                • Size 85KB
                                • SHA256 1b23fb51f647f2f0af7a4846f3915140594f0c516d3c72efb03861991826e611
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_1280.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WCRY
                                • Size 312B
                                • SHA256 79224ca03ef10b5325f9ba426faf7c99926ac9e9d477451984824ce43fe2859d
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_16.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WCRY
                                • Size 1.0MB
                                • SHA256 92d0413c8c2d2e91f3c12432e334ee30cebeca86b959ee901d626d4b61f35c39
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_1920.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WCRY
                                • Size 312B
                                • SHA256 037b3b41e289bc3a6b07a3ee0c3da45471b222f2001e83ebd5767861195269ce
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_256.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WCRY
                                • Size 3.0MB
                                • SHA256 a9538bafcc9b48334c101638ca2b148cf35cfebbb22267c839bc472688674b81
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_2560.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WCRY
                                • Size 312B
                                • SHA256 eb05ff0a86df5785b3c9fa644eb8dadf2c14fb68600aa3dd85277d2ab877fcf3
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_32.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WCRY
                                • Size 1.0MB
                                • SHA256 8e04028fac2a26da9370bfe622b41062629b4ae73ce1378ac3884835de3bf82c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_48.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WCRY
                                • Size 2.0MB
                                • SHA256 72821cf26d3a95ac7ae5cae2383c542c1d0f98d61cad2ce3ec5f0e874e10245c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_768.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WCRY
                                • Size 312B
                                • SHA256 a3ac1443aeb2d12416a02a267075b0290e5fbcef70dc363c43e7a82cda72efdc
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_96.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WCRY
                                • Size 312B
                                • SHA256 4698f3ac330f906828f692f2934a52aad35dd75501bda70815100c05ff48c3ed
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_custom_stream.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WCRY
                                • Size 312B
                                • SHA256 89daea5e68c217a34c86624700aaa7ef205ace88635dd75fd5e30b188c9a9cfe
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_exif.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WCRY
                                • Size 312B
                                • SHA256 6a247550fab4509f98e8b1a4a53bb8c4abec1b048c1353ff6178fca16f2c8034
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_idx.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WCRY
                                • Size 28KB
                                • SHA256 0241b213d92e7b02fb849da0858c655ab060abcd29f940a78efa70ac1ca255d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                iconcache_sr.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WCRY
                                • Size 312B
                                • SHA256 d3cf9af400e35b1e17b5e52a1db32d441e9f224645c61997fa8280ee5e08e7d6
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_wide.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WCRY
                                • Size 312B
                                • SHA256 aae9b6546fe48ad3412ad8b4c99c4921d9cc3050192c4c02c790365b02523442
                                • MD5 SHA1 SHA512 TLSH

                                iconcache_wide_alternate.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WCRY
                                • Size 312B
                                • SHA256 7e568c4b083925f540ba86ae20464a9e6370676bc03dd06f3335a52da619da95
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_1280.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WCRY
                                • Size 312B
                                • SHA256 618b5fa0eb43a7d0bc2db731748cb9a567be42d0d65c12bac88c688e8dc0fd71
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_16.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WCRY
                                • Size 1.0MB
                                • SHA256 4d5883fdc1285eb6c797595f6bfa0b70bcd3422e676021ab49cf68e288bd11fc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                thumbcache_1920.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WCRY
                                • Size 312B
                                • SHA256 eee1a4740949db12fa55d2d427ca123d20a3c7382ee8eec65d71286cc06277f5
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_256.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WCRY
                                • Size 1.0MB
                                • SHA256 0863acfd9184e9fc4ca3c3d916962aa2ebd0ac303407b9b6f9a7080165bc118f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                thumbcache_2560.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WCRY
                                • Size 312B
                                • SHA256 296eb2bffba1d78c377955c9e3a9789d5fa697e93f75133cbbd4adf6c8eef350
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_32.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WCRY
                                • Size 1.0MB
                                • SHA256 019a711c0118be8fcefda4a3037d95214a7fc84fc43923efd15c0f7654cbc8a6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                thumbcache_48.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WCRY
                                • Size 312B
                                • SHA256 5305a834e701bf9cc7e0a8623f2a290c16ea7885fed60f453ecb3ba4786ef8dd
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_768.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WCRY
                                • Size 312B
                                • SHA256 c85c3ae8c4896724abcb9d20058254095aafe4a61fefeb85cac993057b85475f
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_96.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WCRY
                                • Size 4.0MB
                                • SHA256 ae94f7500b47f53b99bdd110d78292ebbdbb1d4492618ef0e22e065382c6e311
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                thumbcache_custom_stream.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WCRY
                                • Size 312B
                                • SHA256 5abfa4c539e963ecd226a15eb16d76b95e7958578a0fa6010420212d3d1e9e2a
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_exif.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WCRY
                                • Size 312B
                                • SHA256 69ef1f8da4fdd720fcf26f695d8fab06c0c0dddc86d8c53898eb5e80550591d8
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_idx.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WCRY
                                • Size 14KB
                                • SHA256 a266e3313db025e3ee46e2d9dc768db5af87b2fc9b5659ddb65922ba6aaf2bc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                thumbcache_sr.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WCRY
                                • Size 312B
                                • SHA256 3fa545e0e0676a916806e3d3cd5a8aaec2128792747af5198571ec790c373c4a
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_wide.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WCRY
                                • Size 312B
                                • SHA256 c9133c4c8d2779738a363b168a9da90aa13ebc42165117c1ff7597b76ac4eba3
                                • MD5 SHA1 SHA512 TLSH

                                thumbcache_wide_alternate.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WCRY
                                • Size 312B
                                • SHA256 831377353596b5ba2c78d9173c0768ff9dfc37fdf9542a9cd1e10044c82f21e8
                                • MD5 SHA1 SHA512 TLSH

                                {8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LBHX3A6T\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WCRY
                                • Size 6KB
                                • SHA256 08cbaede2cc5ce814066f719392cb022446d22865594a9e6a0295871c94e2684
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AAehyQC[1].svg.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RNU3R319\AAehyQC[1].svg.WCRY
                                • Size 3KB
                                • SHA256 4fee13150428ee22e3fdb29c56bf2d8f18779b367bc186103a3c80d05bc0716c
                                • MD5 SHA1 SHA512 TLSH

                                wpndatabase.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WCRY
                                • Size 1.0MB
                                • SHA256 5077d2ede1bde292c100820cf7247effa4abb3eade8244a763fcde9c6002b561
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                squaretile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WCRY
                                • Size 2KB
                                • SHA256 9e733a594eb404cd06264d35364cb2a73c72a375af431e2c1968fd34a7e6c3ab
                                • MD5 SHA1 SHA512 TLSH

                                tinytile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WCRY
                                • Size 1KB
                                • SHA256 8a6356cac2cff04f7f95484c9e900489d1a32e4a06901a6a7c245464c3a9bbf5
                                • MD5 SHA1 SHA512 TLSH

                                squaretile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WCRY
                                • Size 2KB
                                • SHA256 c89d35cdd73f355e56122d436cf71215abcb6816db8265afe946eb3a27e8dc76
                                • MD5 SHA1 SHA512 TLSH

                                tinytile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WCRY
                                • Size 1KB
                                • SHA256 2484c347449d2e9b312309ff2fa81713c7b34101c501e3480ee9f12f626ba26e
                                • MD5 SHA1 SHA512 TLSH

                                squaretile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WCRY
                                • Size 1KB
                                • SHA256 82fba32e2dcd1e98c10369f14aa5dcfb8af513309bd5c25dc46b48b4d3d8b59c
                                • MD5 SHA1 SHA512 TLSH

                                tinytile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WCRY
                                • Size 1KB
                                • SHA256 eb460e5c624b6037b1588c7422321e1200516135d2019e2359af3e92f410a1d0
                                • MD5 SHA1 SHA512 TLSH

                                squaretile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WCRY
                                • Size 1KB
                                • SHA256 f9a8f816444289abbe7bc158dd44e54ce3c8016058676b56d6ffc7451d51ed76
                                • MD5 SHA1 SHA512 TLSH

                                tinytile.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WCRY
                                • Size 1KB
                                • SHA256 81db298c8cfc93cf6303ec7a3c79790af736ecfd7fc0be3186810479ca48ce4e
                                • MD5 SHA1 SHA512 TLSH

                                odc_homepagebigarrow_ltr-060c245a73[1].png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\2WXKRI04\odc_homepagebigarrow_ltr-060c245a73[1].png.WCRY
                                • Size 5KB
                                • SHA256 b37190dfaecbe9ccb435a493137ff14026806c16adb8d758bafb44c382a8084a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_10[1].txt.WCRY
                                • Size 197KB
                                • SHA256 440a1d26c891ecec3087e71f832a3af7382de363c500c61149abd7fb4c97dc53
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_11[1].txt.WCRY
                                • Size 33KB
                                • SHA256 7e62992eb8d20ce354d909f2ebdf8b0385d6690217675f8cb8128881daf9b633
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_12[1].txt.WCRY
                                • Size 221KB
                                • SHA256 875478a672dd3266a1e34d8df557902273895a89eb03eb0b1f63edf2bb123e67
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_13[1].txt.WCRY
                                • Size 52KB
                                • SHA256 55e957302e8afa84c4120fcd058186185c55b52256057a5341b1be40f0a5eff0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_14[1].txt.WCRY
                                • Size 7KB
                                • SHA256 b83517e4ea079ec68a748d56d4dad587719380fd0b3ba8d946cffd932310f31e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_15[1].txt.WCRY
                                • Size 120KB
                                • SHA256 aaf84e65426c118693b3924ee3429736a541305f9565f096077a391780203dfc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_16[1].txt.WCRY
                                • Size 92KB
                                • SHA256 da9324aeeda71881adfe350b14163afe33b02182ea331e4e77d96d0b5df5324c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_17[1].txt.WCRY
                                • Size 6KB
                                • SHA256 fde3eb7f6667b88a613ffd3052c64516780f01991c371330dbbfd8c7c61eb341
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_18[1].txt.WCRY
                                • Size 119KB
                                • SHA256 89ad2d9dd08ec76e7d7c381b8fe19ea2a2d29d28e15f115fa5dca01718a82628
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_19[1].txt.WCRY
                                • Size 118KB
                                • SHA256 560c48716990e81ded4e33b936450bd8901c12ba602ad71d1adee463fd9519e8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_20[1].txt.WCRY
                                • Size 64KB
                                • SHA256 1db4e713388e8bee7625c8ea2466f5d3323d1994ff0d08be212d399f4eb47e9b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_21[1].txt.WCRY
                                • Size 44KB
                                • SHA256 dd6f1b430198c9a9da10e2624c4175881c03a368cc9c5e76c69e00ee06ceda16
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_22[1].txt.WCRY
                                • Size 197KB
                                • SHA256 671ddddc694b708fccfea75cdf749ea9a2e568e117f6056a2eeacaa456310ba1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_23[1].txt.WCRY
                                • Size 15KB
                                • SHA256 719e2900a634807da37a3327a269b8343c46695636e7c1a4a896ea5423aeddd8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_24[1].txt.WCRY
                                • Size 48KB
                                • SHA256 d53f616cbccfb7e118d2030bdff6c5734ca48fd9dbca11e397dff92a37a406a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_25[1].txt.WCRY
                                • Size 39KB
                                • SHA256 70acb2ac3b185aed7c2ee4b05e3ee8368dc772a416aba70608b8c42aace6d42f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_26[1].txt.WCRY
                                • Size 780KB
                                • SHA256 c34bdf0d5ffb363f5f45dd1f20df1cc8ad1a8ba7ea5b28651db86025e215cb24
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_27[1].txt.WCRY
                                • Size 87KB
                                • SHA256 c9abe2d05e4c0567bef0eeddf3d07c385d315b88329fc3b40a8255fb16df0565
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_28[1].txt.WCRY
                                • Size 181KB
                                • SHA256 6308ad4c635e1fd16a33ed4805b5bd66b3fba00c6ee92beddad058db75dcfb5e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_29[1].txt.WCRY
                                • Size 17KB
                                • SHA256 456efe7c1b9bb008a2d183a4c84a346971554b133c54a59886d75fc930d3a3bf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_2[1].txt.WCRY
                                • Size 72KB
                                • SHA256 c582221917dab6486bb72520074d8f0a854ac07061cac491aa09fad5f8106f87
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_3[1].txt.WCRY
                                • Size 18KB
                                • SHA256 804818ec4ee79a8743f65c079e3b4eb143d102ff4c8dca3d93a5ef50b9a8e9c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_4[1].txt.WCRY
                                • Size 20KB
                                • SHA256 64681edbc53a20fa5e9f4546b0cc221b852acdd58ea0b8adba8416e185e7d3f5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_5[1].txt.WCRY
                                • Size 1KB
                                • SHA256 1b7d80fe6826456dda1188e0dffe98ae0c649d22f98eabd61c16e9e3f6b08dca
                                • MD5 SHA1 SHA512 TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_6[1].txt.WCRY
                                • Size 36KB
                                • SHA256 4e7893217c22a1ad446e2ba666efc12196e2108117b7b2358a9fe377a89e7375
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_7[1].txt.WCRY
                                • Size 165KB
                                • SHA256 2546b49ccc71b3453b5e0bbe956c360159de04fd7a47e53e918681e964ed85a5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_8[1].txt.WCRY
                                • Size 50KB
                                • SHA256 df5988caf2e41dd77f453a556226106708fd5c79d86aad2cc3cbdfe093860c7f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\ES08DFK2\1\C__Windows_SystemApps_Microsoft.Windows.Search_cw5n1h2txyewy_cache_Desktop_9[1].txt.WCRY
                                • Size 67KB
                                • SHA256 6dcf7dfddd4ed56e2608c72e9f7885563bfd2c7a2fab5b7463e3c32e823d85bc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                0.0.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3e6dadcc-1e10-4aca-9506-59f0ba80cad1}\0.0.filtertrie.intermediate.txt.WCRY
                                • Size 30KB
                                • SHA256 bdecbf4d022b28b3706b41f76497f01e9799a070fa1fb4ded4d0838df69898ae
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                0.1.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3e6dadcc-1e10-4aca-9506-59f0ba80cad1}\0.1.filtertrie.intermediate.txt.WCRY
                                • Size 296B
                                • SHA256 f9d2ff739edef2cb1e746b21616c2ca1332c154ed2bcaec11777cb2e3836dcf8
                                • MD5 SHA1 SHA512 TLSH

                                0.2.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{3e6dadcc-1e10-4aca-9506-59f0ba80cad1}\0.2.filtertrie.intermediate.txt.WCRY
                                • Size 296B
                                • SHA256 ad567be47c1fa599a3a6e12e757e33773e58b32526c5a4dd909ef609b35d8901
                                • MD5 SHA1 SHA512 TLSH

                                0.0.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9c5d5757-6c11-4da8-8882-784504d67f17}\0.0.filtertrie.intermediate.txt.WCRY
                                • Size 30KB
                                • SHA256 11daa316efc9ea33374029c3e550abe91af5d3afde220cdf18a730dbc6b6b115
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                0.1.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9c5d5757-6c11-4da8-8882-784504d67f17}\0.1.filtertrie.intermediate.txt.WCRY
                                • Size 296B
                                • SHA256 c8a089ad959bd33a7b360bae7dd23c7d8d90c631ea9ca1b16dcec2e9072ae799
                                • MD5 SHA1 SHA512 TLSH

                                0.2.filtertrie.intermediate.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9c5d5757-6c11-4da8-8882-784504d67f17}\0.2.filtertrie.intermediate.txt.WCRY
                                • Size 296B
                                • SHA256 6ff63c8c88c11ea1bcbbf64a1a588b5def164a5c31192ec3f662521a140cf1cc
                                • MD5 SHA1 SHA512 TLSH

                                appsconversions.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\appsconversions.txt.WCRY
                                • Size 1.4MB
                                • SHA256 f57e3034f4baba26f98f4ca7b6f3d2046a4fe025209916300967074124745df4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                appsglobals.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\appsglobals.txt.WCRY
                                • Size 343KB
                                • SHA256 e653b2a92afd423ff8819bc96e84d87ec7b915b2144117e529dcf84705f13ee6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                appssynonyms.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\appssynonyms.txt.WCRY
                                • Size 238KB
                                • SHA256 ba1dbf950932c85ff54369f751c1908ed40547d299d2074ec7b1cee02078d305
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                settingsconversions.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\settingsconversions.txt.WCRY
                                • Size 520KB
                                • SHA256 e4fbaabb7956e4b57335b5b3700c2d38dc354e90e9a76f87b18b0fbd30500c2f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                settingsglobals.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\settingsglobals.txt.WCRY
                                • Size 43KB
                                • SHA256 813423f8bdbbbf0d3ef3654b7cabe3e40e200a8df7f5c460d9d2fe2c31deae67
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                settingssynonyms.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{f11e6496-72f5-4ce2-b9a1-9bbf45269702}\settingssynonyms.txt.WCRY
                                • Size 101KB
                                • SHA256 2a994fa1671011dcca55be977ee3dc3d473c9d3715bc883210524eb63b1a46c2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336127751616602.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336127751616602.txt.WCRY
                                • Size 76KB
                                • SHA256 09bbbec12f61750f8802e71c10abada1f14de1943a00c4e8d0bf3a1eaf59176f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336128437792029.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336128437792029.txt.WCRY
                                • Size 77KB
                                • SHA256 4a90b6dcd801d300ddc418c781ff00e3fa1b16c4a2c37a8278db20718367e827
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129122302424.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129122302424.txt.WCRY
                                • Size 63KB
                                • SHA256 2997aacaad0bcab3ba3ad626fc0679ea09e802e817f7fbfe5b4189821e1f7ee3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129484732777.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129484732777.txt.WCRY
                                • Size 63KB
                                • SHA256 a5f04a7d6497478383fea710f0599c73f86619b56506f7763a349f5ff3de49af
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129493118492.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129493118492.txt.WCRY
                                • Size 62KB
                                • SHA256 1000837e66b37d667ca32f6831b3a9fca68c7a059ff1bfa1aa4da5e0a1f534a2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129499175665.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129499175665.txt.WCRY
                                • Size 61KB
                                • SHA256 4aea51b23da6a73d16022cdca81651637dc42800c687e0adbfcfc2ae5cd43545
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129508011967.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129508011967.txt.WCRY
                                • Size 59KB
                                • SHA256 016ce2b80c19840f14831b88bcefad09e812515efbeb1ab94363d6f52fa7a202
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129547442915.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129547442915.txt.WCRY
                                • Size 53KB
                                • SHA256 2d9cb3f00be476a36eeb7deed06bdb0b19f3cf263c658dffe137343aefa0bb78
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129790105383.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129790105383.txt.WCRY
                                • Size 47KB
                                • SHA256 51c53e9db7033eb5cea2efef3e0d2fb52e9445b44a538f599c18951ecab8adea
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336129847236923.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129847236923.txt.WCRY
                                • Size 47KB
                                • SHA256 b05d1f1e0896ccda5eeda5732b7d037a6edd0106f862402d68aca11babd6946b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336130243590164.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130243590164.txt.WCRY
                                • Size 47KB
                                • SHA256 c960614c58b49140ec3145bbd7e3ea8c851d7a897f0fc70149e634931ef86be1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336135659074551.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336135659074551.txt.WCRY
                                • Size 48KB
                                • SHA256 32457d92ea3b16a2501e75ffd52c923ab71df8a1b6e90fd0ce8586e51263cdfb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336135988798051.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336135988798051.txt.WCRY
                                • Size 49KB
                                • SHA256 b825f5848ab38f72fa3b0b76e4ed1cee605307f78aaf34023f986c60e168501c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336136296739548.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336136296739548.txt.WCRY
                                • Size 53KB
                                • SHA256 a961f36fd8de52433a2cc57ba8d396ead14cb194a281e3e2a79bfd51a394d3b5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336136897916591.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336136897916591.txt.WCRY
                                • Size 64KB
                                • SHA256 589a3d03feea3e81e5ffa78e00d979edd33a88d1e62e31b1f238836676beb982
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336137384479942.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336137384479942.txt.WCRY
                                • Size 64KB
                                • SHA256 8eb4e3f53e938c91d9d9ce62e0148e93e1fa08ee7d50c05210ba85fdb6c741c9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336137496324734.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336137496324734.txt.WCRY
                                • Size 65KB
                                • SHA256 edae3b8ccd00dbc3cacb3f556c0e86178349d3b01de7a3885f11157167299818
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336138734704433.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336138734704433.txt.WCRY
                                • Size 67KB
                                • SHA256 83f6eb07e776f359dcad19f7b29fc97999e1d16364bd6b8413671ef3579f22ef
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336139034379356.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139034379356.txt.WCRY
                                • Size 73KB
                                • SHA256 5b9c3d7650b9f8244fb0bc38407053bb3f70aa87d80b8d7ff7a23048e5a26d1e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336139334552170.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139334552170.txt.WCRY
                                • Size 82KB
                                • SHA256 226d5e5c9feab7ac3b0605c5dad02e99f3f3e90d565efe63cd8a9c5b21cb3092
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336139686243711.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139686243711.txt.WCRY
                                • Size 82KB
                                • SHA256 3ea3a7480f2fbad3974e61da8fbc8b2b28caa769849b8accd8a082de998d67c2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336139992038046.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139992038046.txt.WCRY
                                • Size 84KB
                                • SHA256 9083dbb82ed7c6bf46afe5f82e40de76836347417ac72c0499713d056e6b67fa
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336140294772893.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140294772893.txt.WCRY
                                • Size 85KB
                                • SHA256 a670debaea821396ad48974382e5a906d30780fe0c14011874404bc0c709a18f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336140588925207.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140588925207.txt.WCRY
                                • Size 85KB
                                • SHA256 fa0f7a410af7fd4d4e68df0550605314c4b1cbfb097f554c63885a003079b627
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336141661462233.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141661462233.txt.WCRY
                                • Size 85KB
                                • SHA256 3220874acf9f7e32143dd676a181ba8c47934449da0d3309e27c4e9c5b8c9453
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AppCache134336155121913488.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336155121913488.txt.WCRY
                                • Size 85KB
                                • SHA256 a1013704bb413ea7f1a5e677f2a159e7bf965009d64c5c76f0498f8b555856e3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                14.WCRYT

                                • Path C:\Users\Admin\AppData\Local\Temp\14.WCRYT
                                • Size 24KB
                                • SHA256 5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                17.WCRYT

                                • Path C:\Users\Admin\AppData\Local\Temp\17.WCRYT
                                • Size 85KB
                                • SHA256 5c9c8c0832c4679d0c4ec8509c264d124115af909fcf47e82e2b3a4170e67e23
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                18e190413af045db88dfbd29609eb877.db.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.WCRY
                                • Size 24KB
                                • SHA256 f856175d7633d0b4366322e89659aaa8fb219fab68316a77914cadc9dd705b73
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                19.WCRYT

                                • Path C:\Users\Admin\AppData\Local\Temp\19.WCRYT
                                • Size 61KB
                                • SHA256 a4a4574f433e987b897bc5d47c56ae4103ae6aa46c9899b726431c1d11a9ca76
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                9.WCRYT

                                • Path C:\Users\Admin\AppData\Local\Temp\9.WCRYT
                                • Size 64KB
                                • SHA256 2b458c48dd20870bb817ae588b91d422cfa27e4610175348e98cdabf7dbfe76e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.WCRY
                                • Size 1KB
                                • SHA256 6e41eb97c82f0ddf464af1dfb484de3cccb148bfdf155c869a2e16091601e9c9
                                • MD5 SHA1 SHA512 TLSH

                                dd_vcredistMSI26D7.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI26D7.txt.WCRY
                                • Size 428KB
                                • SHA256 fb6eab8ce3eb8f51cf20a53a77904bb6a4a67db82d2bddb68df507f7c1bf81cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                dd_vcredistMSI26FF.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI26FF.txt.WCRY
                                • Size 416KB
                                • SHA256 a2b6c3615e65ac4d8208fb17a1db86f89a69f8a225ad38eebc78337cb0338dac
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                dd_vcredistUI26D7.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI26D7.txt.WCRY
                                • Size 11KB
                                • SHA256 ce4093ddd7071717fc1d6ceaf5abbcf8f0873e4a92d902acb6c6523cd7f452d2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                dd_vcredistUI26FF.txt.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI26FF.txt.WCRY
                                • Size 11KB
                                • SHA256 c61eb327c7ec4145c9d2cc82e36013c5d216806cf2fe400237eccdb50aeb2832
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                mapping.csv.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\mapping.csv.WCRY
                                • Size 121KB
                                • SHA256 6cdf14a7e35eb88b5c5f4cd40154d36ffd3eb887eec249632be9f101135fd804
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                128.png.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_1174545856\CRX_INSTALL\128.png.WCRY
                                • Size 4KB
                                • SHA256 d44bb9ce249d11380c36dcd5f3e3a1b39aa560bb174d25c8b1e4d71db5d86218
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                offscreendocument_main.js.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_1174545856\CRX_INSTALL\offscreendocument_main.js.WCRY
                                • Size 130KB
                                • SHA256 e1ea722fa960d681baa9b2f86634190ded5e656d39624011e411ca9394393902
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                page_embed_script.js.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_1174545856\CRX_INSTALL\page_embed_script.js.WCRY
                                • Size 632B
                                • SHA256 1175f9a2431eddf34154eb87ba81818c41e36180ce24eaa612512f77dbae6c41
                                • MD5 SHA1 SHA512 TLSH

                                service_worker_bin_prod.js.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_1174545856\CRX_INSTALL\service_worker_bin_prod.js.WCRY
                                • Size 136KB
                                • SHA256 681a3f2332d39fd5598502d751d919b640872eaac6ef934e66269cd5b1ffa20f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                content.js.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_2067601285\CRX_INSTALL\content.js.WCRY
                                • Size 9KB
                                • SHA256 80a678d70e92df40d80012f6927a03f404c0907a3a2e04a791399b8ce33e11c7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                content_new.js.WCRY

                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1872_2067601285\CRX_INSTALL\content_new.js.WCRY
                                • Size 10KB
                                • SHA256 fcedca41949b9896a5dc805f1a77624642070665b718ec68a0f55b0877af99fc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ApprovePush.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\ApprovePush.mp3.WCRY
                                • Size 439KB
                                • SHA256 85a5a75248c91d986bb7eeef2f35ab8625d3d7c83cb9883480662d858c80da74
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AssertCompress.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\AssertCompress.mp3.WCRY
                                • Size 474KB
                                • SHA256 cf402fb4664fe8091fcc372d7f0d9e6231366e7bb10ceba4d29ca33723b56843
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BackupConnect.raw.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\BackupConnect.raw.WCRY
                                • Size 428KB
                                • SHA256 a6a7d8326b968d2f07db14232f44ce77cefa3fa3c47a43c3090e73ad3d0d3e9d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ClearConvert.avi.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\ClearConvert.avi.WCRY
                                • Size 181KB
                                • SHA256 6e3d0fb7e9ca5a9ebf143fab30619ea04b68196c9e60e5b86527f952c2091080
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ExitDismount.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\ExitDismount.mp3.WCRY
                                • Size 240KB
                                • SHA256 fa6bd41edbc5d107c12913dab5444b1309c1fa6ac59c91e410db0eeef6f0b9ba
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                FormatCompress.tiff.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\FormatCompress.tiff.WCRY
                                • Size 381KB
                                • SHA256 5c648591723429aebae437e5c1ffb9ffffb523eff927a196955c3004541ed7c7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeWatch.wma.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\InvokeWatch.wma.WCRY
                                • Size 193KB
                                • SHA256 2053d37a7343917b1015b67454604151ca3f9aab397031bbad2fb9d1e7ddf077
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MoveEdit.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\MoveEdit.jpg.WCRY
                                • Size 263KB
                                • SHA256 cee0e3048a2580268463520ebed6cd3cca7aacf84be7d1eb97f2700e27ccc360
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterExit.potm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\RegisterExit.potm.WCRY
                                • Size 310KB
                                • SHA256 1615209ab769b08326a49cb8d6a466f66d91e775bc11da9058000ee98b5533f5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SelectRepair.wmv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\SelectRepair.wmv.WCRY
                                • Size 392KB
                                • SHA256 08bbd870a947bb9c23635afef7faf6d481b5024a4d2e5130d355a50cc1e52eef
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SendRestart.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\SendRestart.jpg.WCRY
                                • Size 275KB
                                • SHA256 adf910e09871b921411d4cf5936c19e9340003c740db81cf01909c02390e5e8f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StartUnregister.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\StartUnregister.ps1.WCRY
                                • Size 463KB
                                • SHA256 fd9e82eaded6a7a77e8b5fecb3d8819d66313c23be4c3ec412e0b9ea46b0b365
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StepResolve.m3u.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\StepResolve.m3u.WCRY
                                • Size 287KB
                                • SHA256 8f213e0a48927eef49526be5104e5797f02679a650c8143fcd1757c779bf02f7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StopResolve.docx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\StopResolve.docx.WCRY
                                • Size 334KB
                                • SHA256 11ce79daac8a93996d9fb7a15a9f27e760dac4e72e4b5d5e6790c2eda85c839a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnprotectMeasure.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\AddNew\UnprotectMeasure.tif.WCRY
                                • Size 299KB
                                • SHA256 489b7563064b59257446de49e7cdbb2c964072afc4569f85d76f1cf2d6e22b1c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ApproveUnlock.txt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ApproveUnlock.txt.WCRY
                                • Size 537KB
                                • SHA256 60ed03cb4f659e6ecd64e743494cb47ab76c7d03097c9774f99635541ca3d31e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ApproveResume.vbs.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ApproveResume.vbs.WCRY
                                • Size 189KB
                                • SHA256 9d689b241cc8d878bbc838345cb5d47770c2118a23c7b7fa1bd142bde40977e7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ClearConvertTo.avi.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ClearConvertTo.avi.WCRY
                                • Size 285KB
                                • SHA256 bc554f8602fce9e66f9c23d5c94f7a36d142dea902970702a693ba7d1c10209c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EditRead.7z.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\EditRead.7z.WCRY
                                • Size 218KB
                                • SHA256 37c43af80d12c98ce6276359078421eb5118d919cd8dbb8686bd0a9a6a492f43
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ExportRedo.bat.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ExportRedo.bat.WCRY
                                • Size 181KB
                                • SHA256 71b8f4cd0d9059ea3341badb406528cc65c170c4e96ff5f5a77a805cfc1a0fcf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GetUse.mid.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\GetUse.mid.WCRY
                                • Size 315KB
                                • SHA256 c6259d56a26ea8d215f72a046dffa0e89fb70203055a87baea200bf16aab3a8c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GroupHide.raw.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\GroupHide.raw.WCRY
                                • Size 255KB
                                • SHA256 1982a2f268c4fe2e79482ee94f7d398ea22143691bf80fa5fe1d536defbcef63
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MountReset.tiff.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\MountReset.tiff.WCRY
                                • Size 248KB
                                • SHA256 eb889f6c0030c3f943ca615cbdb1fd59720a4fd7286a80be2ad9aba1a29317c6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OutSplit.vbs.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\OutSplit.vbs.WCRY
                                • Size 300KB
                                • SHA256 35af2c3c1266e20d235bdf18f06616c22a772cefbcfb775aaea9acb79cfac8bc
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PushFind.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\PushFind.tif.WCRY
                                • Size 571KB
                                • SHA256 61f742abb8502c60a26a306a29c711b234a4d948c1f19ee63aa2c8399ad0bd03
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PushRedo.wma.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\PushRedo.wma.WCRY
                                • Size 374KB
                                • SHA256 2e36f2efd16bff2efbbca3781684df5a726c2ca528f10a571553f15e99503f1d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResetWait.txt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ResetWait.txt.WCRY
                                • Size 344KB
                                • SHA256 f257cbce698c8a9eb9e98db070deeaa1e97d4cb9880fd63b85d215718cb7f728
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResizeRestart.wmv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ResizeRestart.wmv.WCRY
                                • Size 418KB
                                • SHA256 841ed906d21da45ff7b78f309e2b066b05b767f804560cf6969a1fc2481cc0d3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResolveSelect.asf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\ResolveSelect.asf.WCRY
                                • Size 240KB
                                • SHA256 466b67cac31883e218c1d3d3ec2b9212089cdc4fe9efe3ac71aa867ac5782632
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StopJoin.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\StopJoin.mp3.WCRY
                                • Size 277KB
                                • SHA256 350b3c3a15cb4c213e9e49be4051325050ef1416214378c6f2ca0775b3ced11c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SwitchOpen.rar.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\SwitchOpen.rar.WCRY
                                • Size 359KB
                                • SHA256 d8119b3aa631e656c72565c06bfac0ec547f7b474e7b3d34c5a61677fbeb6099
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UninstallInstall.pptm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\UninstallInstall.pptm.WCRY
                                • Size 152KB
                                • SHA256 c81390410c93f1770cf9addfd2b7b595e211ea745a225f45c1184adc9ee87997
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WriteExit.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BackupRepair\WriteExit.jpg.WCRY
                                • Size 396KB
                                • SHA256 5d4977869395b4e20a47bde77d12731a925d01eb491b99066ea0c38439da4afe
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BlockUninstall.raw.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\BlockUninstall.raw.WCRY
                                • Size 268KB
                                • SHA256 51af18324848a408c8a3a9ea4f0e8293e02fb64d2e07f86f9a6202ec0395df65
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CheckpointExpand.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CheckpointExpand.ps1.WCRY
                                • Size 604KB
                                • SHA256 172505739175adad96206b2c48aa802890c67a85219b2a12e3ff07133695b024
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CheckpointGet.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CheckpointGet.ps1.WCRY
                                • Size 618KB
                                • SHA256 b9e005173136c9a40649d3d45c6731dbf948f644a86eb583565ea5d80a397a44
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConfirmMount.dot.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConfirmMount.dot.WCRY
                                • Size 242KB
                                • SHA256 bf031fea65c1afe3dd2596478ab770d0577b00e96ba38868380bd5307255b714
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BlockPing.txt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\BlockPing.txt.WCRY
                                • Size 174KB
                                • SHA256 fa9afdf6a918f159264692bbf26036454af6f8f2a0b4869ad1acf7ce5538798a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompressConvertTo.mpeg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\CompressConvertTo.mpeg.WCRY
                                • Size 93KB
                                • SHA256 1ac9b12fd25f03a21d10a84cc77c4452d7df37ec3c2e3c6f4affc56ca501e680
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertUnpublish.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\ConvertUnpublish.tif.WCRY
                                • Size 110KB
                                • SHA256 f081398d18f374e1486f3d0985e29abeb5adaf60a792b8636d8393b991de6215
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CopySave.avi.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\CopySave.avi.WCRY
                                • Size 102KB
                                • SHA256 80d6608f680d1bde3236dd45f5433c1487804ce219f3194c9b5d412079a12669
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GetInitialize.pptm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\GetInitialize.pptm.WCRY
                                • Size 208KB
                                • SHA256 4ae4c6eea0e1f8bc702304c646ad8bfe766cecfd24bbcc9114fa6acf9cad1317
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GrantGroup.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\GrantGroup.js.WCRY
                                • Size 191KB
                                • SHA256 4a4796ce978fba9f09fe804dacd38e72dad05a75f9243a8b4ab040d413ddc922
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeMeasure.wav.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\InvokeMeasure.wav.WCRY
                                • Size 98KB
                                • SHA256 45aceaaf7045684b65816fff678158161f7b6d5710f077b48b743a8d54b77d39
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MeasureConvert.docm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\MeasureConvert.docm.WCRY
                                • Size 157KB
                                • SHA256 e0949a71ae4b9c4923ffe119cd59c65af0298c51833a157063daaf8b12cc9c32
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OptimizeAssert.mpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\OptimizeAssert.mpg.WCRY
                                • Size 81KB
                                • SHA256 6d3d4bf3fe4c1a62bc36c94fcd80c83319ed164f77d55b25bc4cc9467868316c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OptimizePush.mov.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\OptimizePush.mov.WCRY
                                • Size 132KB
                                • SHA256 bfc1b15a7a991ef7b7a0ed989c14929c193adbd739930376f4dad99371f50b1b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResumeOut.odt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\ResumeOut.odt.WCRY
                                • Size 178KB
                                • SHA256 681b16336415e3c888ab3289b08bd77d4ea66c117faa87a8ce4806c39c4b3c35
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SkipConfirm.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\SkipConfirm.bmp.WCRY
                                • Size 85KB
                                • SHA256 051d5291bd2fa9796be50561a7702e519e5478332616cefa62798208c023a5d7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SyncMeasure.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\SyncMeasure.bmp.WCRY
                                • Size 153KB
                                • SHA256 64460d1d2441ac0bcee02222dc8df881ed816ac83407afe4afea8b793b8eb2ca
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TestUpdate.pot.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertEnable\TestUpdate.pot.WCRY
                                • Size 221KB
                                • SHA256 48b80e087707d03e66647194adbd26199e3b554c329d83dfaffc6742da44c0d4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertFromUse.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ConvertFromUse.bmp.WCRY
                                • Size 510KB
                                • SHA256 24e6cc5935a203b9ee47ad8ecfb697bb125739d0102d4af327a1eb6ddc0ab4da
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CloseWrite.xltx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\CloseWrite.xltx.WCRY
                                • Size 135KB
                                • SHA256 aa000e756725a105a234797234f13c11e0cd178b4e25e3c053a640ba0c360308
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EnterCopy.rar.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\EnterCopy.rar.WCRY
                                • Size 184KB
                                • SHA256 ad3d7d324ee7f447800b9bb89ed6de173228389c558c8cfd022fbee1a3a5ae1f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EnterImport.doc.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\EnterImport.doc.WCRY
                                • Size 376KB
                                • SHA256 e252c0afa870555517c184605bb67cecaf7a3b605bdab3cb0b584b827a446011
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ExportUnpublish.vb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\ExportUnpublish.vb.WCRY
                                • Size 170KB
                                • SHA256 516394e22819bcb52685c391943e8cf3b7053d9abe925f5d7cdfe8462aaec556
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InstallDismount.potm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\InstallDismount.potm.WCRY
                                • Size 276KB
                                • SHA256 92cfd5f4f31d43f5b10441281919a61812efd45e35a33edaa14ba030c0b5157a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenDismount.jpeg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\OpenDismount.jpeg.WCRY
                                • Size 390KB
                                • SHA256 1c3674984ff6697549764c3ed100ec427bbfd860cb4d4220497d0c3acba526a3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PingDisable.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\PingDisable.jpg.WCRY
                                • Size 198KB
                                • SHA256 9ddf2c575344a5d4515fd1ad6701d47ea263b7617f76c5301be1044e6a1e9c9a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PushFormat.rar.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\PushFormat.rar.WCRY
                                • Size 142KB
                                • SHA256 50432ed854b3412f878ad1ec24c90aa2869abeb28ed83c90aa7a79c1c3fb490b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestartDeny.cmd.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\RestartDeny.cmd.WCRY
                                • Size 191KB
                                • SHA256 3d1ba4fc3fe84e3837e272c76585e406d9415399b05a2ba67b2a637d414d3e68
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UninstallDismount.asp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\UninstallDismount.asp.WCRY
                                • Size 326KB
                                • SHA256 e494510feece0293b49d208e3173333afc3bbf9d1aabcf441bd094b1deca7bde
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UpdateMove.m3u.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\UpdateMove.m3u.WCRY
                                • Size 319KB
                                • SHA256 2102bc4c1578410d732262d0d993b9ce0f134c79f0258fa31c02d9d93c8b0d91
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WatchStart.odp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\CopyRedo\WatchStart.odp.WCRY
                                • Size 255KB
                                • SHA256 21d8341407f2ea16e608d70d5ea0cdeeb7d6f715de92c4df0e729cce407d698d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CheckpointStop.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\CheckpointStop.js.WCRY
                                • Size 697KB
                                • SHA256 3f60ac3e3b9c77980dfe37ccab8ff2043bd4e9eda9c35b92c5af748a029fbee0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertLock.rtf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\ConvertLock.rtf.WCRY
                                • Size 659KB
                                • SHA256 2f59a66a3370924f61798b3a1038896599d1456791a4ab3c817b148d9e2170c6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DenyStep.xltm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\DenyStep.xltm.WCRY
                                • Size 403KB
                                • SHA256 f02a484080bf533682f5231c57ffd67b2cd44d53eced7acf681b9e2ad47f8949
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                FindSwitch.xlt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\FindSwitch.xlt.WCRY
                                • Size 531KB
                                • SHA256 20edd2f5a1f29e027ca4a6146decd2e7674e2f3fdc13af89a80e31d4b684948f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeUnregister.rtf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\InvokeUnregister.rtf.WCRY
                                • Size 595KB
                                • SHA256 a42f8a46ae75ff7f223dbe8354d9e9bc4775ee5238fb446d844906f0d1e8ac0a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenSwitch.tiff.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\OpenSwitch.tiff.WCRY
                                • Size 275KB
                                • SHA256 6fc6e92829dd5e8955308983b4c45e1622487873edcd6c9221b69b7f36eef94d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OptimizeRestart.ppsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\OptimizeRestart.ppsm.WCRY
                                • Size 479KB
                                • SHA256 fd588b95fb9a33cb8507e1f50e0ccd7d372b6bcabe4d5584c28077dfa88b3d10
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PublishInitialize.mov.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\PublishInitialize.mov.WCRY
                                • Size 723KB
                                • SHA256 02939fc60174c6869f011ec7d8397a1b2517d6b5db13179f04f774728c1d1a6e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RequestSet.asp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\RequestSet.asp.WCRY
                                • Size 569KB
                                • SHA256 4ed37fc837b953dcd1f5f67c8a27a4ce873ce4b66a3badd627cc2418a6352caa
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StartJoin.xlsb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\StartJoin.xlsb.WCRY
                                • Size 518KB
                                • SHA256 9248a0df1d35faf13bc48be0b8870aab1f1826ebd11da51b64aad945226cbfd8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SubmitCopy.docm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\SubmitCopy.docm.WCRY
                                • Size 313KB
                                • SHA256 ea1cad6bf74887860f9a51c745de8bfa971d112fd937555b64ada1590c0b3f4a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UndoResume.7z.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\UndoResume.7z.WCRY
                                • Size 505KB
                                • SHA256 d50d84934bf409f97763008b5565132c2c3fa02e87a90ab782c8fb4300c54100
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UpdateApprove.xlsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\UpdateApprove.xlsm.WCRY
                                • Size 416KB
                                • SHA256 e8c336d4827d4a5a220f2d08dca7369dc3a3ac64df1f40a82680f804786bb849
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UpdateProtect.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\UpdateProtect.mp3.WCRY
                                • Size 428KB
                                • SHA256 e80bd0197e5851c0f5a03ca27a9bbeaaea10b1e59c0be54e1a3ca1478e47acc4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WatchMeasure.xlsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\DenyUnprotect\WatchMeasure.xlsm.WCRY
                                • Size 262KB
                                • SHA256 c083bd0b976e540b6c84a9c04b6923d299db9b460138bc76bbc4cca27b611ea0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EditSet.vb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EditSet.vb.WCRY
                                • Size 376KB
                                • SHA256 c66dc89e92c4aace183d8d09fb883e8db66845fe63886b19c74da447b6050328
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ApproveRedo.cmd.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\ApproveRedo.cmd.WCRY
                                • Size 230KB
                                • SHA256 1fedcb8e3ac592fb818a53f36487a91cbf3ac9bd4ad7cd96b12b78227b00d778
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AssertExit.pptm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\AssertExit.pptm.WCRY
                                • Size 510KB
                                • SHA256 8abfd1933a2df5725d2241a9ef8ed2830db8fa42bddd0b734a40ad39e0c3dd1a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompleteUninstall.pot.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\CompleteUninstall.pot.WCRY
                                • Size 331KB
                                • SHA256 79fb292bb6adc3b53fd588e94ea1a3ff11a1fbcd7e751c0de757fae8a081cb6d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EnterAssert.csv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\EnterAssert.csv.WCRY
                                • Size 353KB
                                • SHA256 6bbaa90ada7cbb04565e3e3ec60678538686995f41e22f2826cbe4358fdbb7db
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GroupRestore.tiff.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\GroupRestore.tiff.WCRY
                                • Size 488KB
                                • SHA256 79fa0cc68af5ad7a6a99fccbe3168e28e295d4ff00c13f9dadf148f5d94618d2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InitializeSave.svg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\InitializeSave.svg.WCRY
                                • Size 443KB
                                • SHA256 3c0ab7c3275e04877c6952fc98a6704b377bb926e07fa792900398816bcf6ebe
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                LockMove.csv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\LockMove.csv.WCRY
                                • Size 819KB
                                • SHA256 82b0a5875a0cc02ba6e18c4d2b34406975130e0bf9cf66d1f12359d66e2d6ef2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MergeRestart.ppsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\MergeRestart.ppsm.WCRY
                                • Size 409KB
                                • SHA256 c758db20070344fd91f01bbd4736edc29e39f8df8c840b22438cea28a1e7166b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterFormat.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\RegisterFormat.jpg.WCRY
                                • Size 533KB
                                • SHA256 8e2c82c09fa9748a7b82899ca17f947a3242ab439ef512f74b3cf0eb2ef5db3c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestartPublish.xlsx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\RestartPublish.xlsx.WCRY
                                • Size 555KB
                                • SHA256 05a3ad4ec280c26537f20e6be49944e7e6d8fdf8d5d6a8f0a8988d613aeb15ac
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestoreTrace.mpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\RestoreTrace.mpg.WCRY
                                • Size 364KB
                                • SHA256 0f90ff5e73ebb8a86d7afe4297d5959cfb19494c2e50926eb35b64653c2cdb4c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestoreUpdate.ods.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\RestoreUpdate.ods.WCRY
                                • Size 320KB
                                • SHA256 fbc4500794a060b47f393c9e44accc2c9d4349ec5d50e1c1325f6d93dcef9d21
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SearchSave.odt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\SearchSave.odt.WCRY
                                • Size 566KB
                                • SHA256 3c8818f0dbf323998b7873a9bd21e4e6f2acb40168df3a00521f58283409a4ba
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ShowWatch.7z.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\ShowWatch.7z.WCRY
                                • Size 477KB
                                • SHA256 5f44417fdab1eef1294ddb045a5123dbd036e91092ad6db04d41eedea04998c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnlockOpen.pps.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\UnlockOpen.pps.WCRY
                                • Size 241KB
                                • SHA256 3a9928398903a528584e0ab20cdb0bec4212a44201238ad929f6967f72d068c5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnregisterSubmit.pdf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\UnregisterSubmit.pdf.WCRY
                                • Size 544KB
                                • SHA256 ff87ae46f11c81b5a81b761b8668f1f28a660b07cb77f36c4593647a8496fd16
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WatchInvoke.dotm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\WatchInvoke.dotm.WCRY
                                • Size 308KB
                                • SHA256 c8aa74f7dafbf9a7a8a66a843301fd96ee64b0f35fe53084eb64c599d99b8c3d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WriteAdd.potm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\EnableDisconnect\WriteAdd.potm.WCRY
                                • Size 275KB
                                • SHA256 9cfb4c3aac9ac39e369d67e6e7e8c5f5daf676d38b682293efac6daca03a6061
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BackupComplete.mov.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\BackupComplete.mov.WCRY
                                • Size 381KB
                                • SHA256 ef36b1c0f24ab70ee5921107cdb72c86c29ab47b1a1ab10b9d1e8fa2dee2ac5e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CloseUnprotect.odt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\CloseUnprotect.odt.WCRY
                                • Size 332KB
                                • SHA256 63e3b156337cbd1d4228b085d8ce3e04e1f250ea3fde3c697bc076c2ab83179e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CopyUse.pps.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\CopyUse.pps.WCRY
                                • Size 651KB
                                • SHA256 425983874ea415d6b138532ac9ffee209fea5bc40fba43872ec015347c62ed45
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DenyOpen.pptx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\DenyOpen.pptx.WCRY
                                • Size 799KB
                                • SHA256 97163e70748b6539f9e2df9d8f8590ac1b77a742bb8acf9f4d9fb83a54ee747a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DenyUnlock.odt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\DenyUnlock.odt.WCRY
                                • Size 725KB
                                • SHA256 5c96da7c38b17dbcbe484e21b0145253b0d36b8b461c3431b362b267456f1a36
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ImportExport.ods.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\ImportExport.ods.WCRY
                                • Size 823KB
                                • SHA256 8e5dd6e9fe77f6731ea6df207fde1fd34418a19fc72a3469be82f7f054ee343a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InitializeComplete.xltm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\InitializeComplete.xltm.WCRY
                                • Size 553KB
                                • SHA256 1129672b60f46fe9b7c8efbb60a55adfa93d6315c0a88d7275ef4d46d217cd41
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MergeShow.mp4.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\MergeShow.mp4.WCRY
                                • Size 577KB
                                • SHA256 a5e28fde727353da54177c2610c9c2ebf57576041bd3c1fe246e17bffa3460c3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenStep.mpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\OpenStep.mpg.WCRY
                                • Size 504KB
                                • SHA256 802636479ee8af6315612ac71a87145b7862faa6de168d46b8cff513ad8f1bde
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PingConvertTo.mpeg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\PingConvertTo.mpeg.WCRY
                                • Size 872KB
                                • SHA256 d57ab83ab84c470205725c589b3e8ad87bfda22bbdbde122388b10e44710be37
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RevokeEnter.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\RevokeEnter.js.WCRY
                                • Size 307KB
                                • SHA256 2d82bbceee1ae420d65a5a54a024e7d1f3b461a74effbf5af19067915bc94add
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RevokeNew.php.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\RevokeNew.php.WCRY
                                • Size 626KB
                                • SHA256 8d2f369afeb30bdfb8fc5541e2587c7776eb86cde695d8f7b34eec343707ea14
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SaveCheckpoint.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\SaveCheckpoint.gif.WCRY
                                • Size 848KB
                                • SHA256 1fb6b1da449c18518d262169f1107e67f2e88990056f34ca4332f94fd2b6ec91
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SendPush.docm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\SendPush.docm.WCRY
                                • Size 1.2MB
                                • SHA256 b5085aad277a5597f5e07a64b330196bcd0616d216616fbe353d42065dde5439
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SubmitClear.vsdx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\SubmitClear.vsdx.WCRY
                                • Size 430KB
                                • SHA256 4e1ae511a11a7860f579ee6b584a73bfb78900e940846ce9dd90a250ae19f41b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WatchMeasure.vsd.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\WatchMeasure.vsd.WCRY
                                • Size 454KB
                                • SHA256 aa7c78e4018c870debd6ed75f90fc494cf45931745405325c451b567e508a711
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WatchSuspend.vsdx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ExitUpdate\WatchSuspend.vsdx.WCRY
                                • Size 528KB
                                • SHA256 de7b208e5fe71ad2400d615c292588c593fe19b1d51ea67474bca850c5dd269b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BackupUpdate.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\BackupUpdate.jpg.WCRY
                                • Size 254KB
                                • SHA256 c3a17c77fe874c75ff519666c30cdd4e546f5f1499956c9975b1151b798e9b2e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompressProtect.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\CompressProtect.gif.WCRY
                                • Size 200KB
                                • SHA256 48efefc0926f78716c92fee5c27d07b9e217fc610c94b27bbbb85e7f3c7e4441
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeInstall.m3u.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\InvokeInstall.m3u.WCRY
                                • Size 463KB
                                • SHA256 52aa2e159d11a5dbd4f7863c468722cb48dcca4014852f61d380f6bd3d7cea44
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                JoinReceive.cmd.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\JoinReceive.cmd.WCRY
                                • Size 136KB
                                • SHA256 fbdb3cde49d7d3ea1106b86eee000110f7cbdacc8c6dbe5a287285fb66ee8da4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                JoinUninstall.ppsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\JoinUninstall.ppsm.WCRY
                                • Size 291KB
                                • SHA256 1f788235e75c9a4f9e7db47d0227d2ec8ed5e3a4f1906f70312b992e0123fc8b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                NewBlock.rar.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\NewBlock.rar.WCRY
                                • Size 263KB
                                • SHA256 50c5c524c972f04bd6be08f590d3920f13b9103af521e711818edeec23a882d4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterFormat.odp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\RegisterFormat.odp.WCRY
                                • Size 145KB
                                • SHA256 849698adf2d87a83aec25b49c2087b8b95ceb92c02e1d10d41fa48027a795f9c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResetEnter.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\ResetEnter.gif.WCRY
                                • Size 163KB
                                • SHA256 620f5c6b3c1cfd4c1294d117852ab23b9b3d74f945a70faf1cc7dec899ec79b1
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResolveComplete.rtf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\ResolveComplete.rtf.WCRY
                                • Size 318KB
                                • SHA256 719642a2dc82bf5a9abe89030fe179579747258d58f9cc5695562e7451c1afad
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RevokeOpen.rar.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\RevokeOpen.rar.WCRY
                                • Size 236KB
                                • SHA256 9e959ba6a362930827cee61639c54ec6f9072f87779f62092f8e0fb943b9efee
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnregisterConvertFrom.vsdx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\UnregisterConvertFrom.vsdx.WCRY
                                • Size 272KB
                                • SHA256 9d97519c12196ec183f9a40f9370edcd9904ccefdcf0082cd7d5ac41a763de17
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnregisterSubmit.mp4.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\UnregisterSubmit.mp4.WCRY
                                • Size 227KB
                                • SHA256 92faf0a5ac2169f9ed34dd54d6cacbc524c390a3145059b13a459d0a1a354026
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WriteConvertFrom.dotx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GetSearch\WriteConvertFrom.dotx.WCRY
                                • Size 118KB
                                • SHA256 e20f4b6a620af236ce908400b6347016f31df531233086b9ed37a485eaebabf4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ClearSkip.asf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\ClearSkip.asf.WCRY
                                • Size 228KB
                                • SHA256 40f2eed70719667cdbc370104dc74265a67552b8b5560a7846c15d149f514081
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CloseFormat.png.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\CloseFormat.png.WCRY
                                • Size 180KB
                                • SHA256 84f1905a558b0e6a3830aa3cf57b8ecfb57aa436c33abb0894461546515c5881
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DismountResume.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\DismountResume.gif.WCRY
                                • Size 240KB
                                • SHA256 ceb8bc71e26ac374f38bd51458b5659b7875c2ca37b7769974854a4d1178ac8a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GroupWait.vb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\GroupWait.vb.WCRY
                                • Size 276KB
                                • SHA256 31f1d143aed96c442e95443f299701d20032f49c6df4b66686827bf465aae624
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RedoUnblock.mpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\RedoUnblock.mpg.WCRY
                                • Size 222KB
                                • SHA256 6ea9f265f3a4070ae07d2bbaea055e2019961158cb5992f599b4844bedcb39b3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RemoveClear.svg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\RemoveClear.svg.WCRY
                                • Size 108KB
                                • SHA256 382a83b651eaacece716756c1fbeba1d140b653c3a45b1c69ed0f78e23aa1d5c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SyncConnect.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\SyncConnect.gif.WCRY
                                • Size 216KB
                                • SHA256 b717f8ce126726927ba60ab38b8f992add21f855a9bb34aee05efccf44b226ee
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnprotectUnlock.3gp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\UnprotectUnlock.3gp.WCRY
                                • Size 174KB
                                • SHA256 fb9b77ec5dbe40206d61199c0e11c0b88c4f929d4be2e9816877795a43a1a54b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnpublishUse.rtf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\UnpublishUse.rtf.WCRY
                                • Size 150KB
                                • SHA256 8bf4adde85b1141c6b9acd2c6264e1ade6510662ab852be562954a7ab49034ed
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UseGet.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantConvertFrom\UseGet.bmp.WCRY
                                • Size 378KB
                                • SHA256 f1211d1fc0665f3b6eb3fa6e77fc96de4d7a6a4f39e18b22ac48308e162da1d3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GrantRename.xls.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\GrantRename.xls.WCRY
                                • Size 336KB
                                • SHA256 51d91777b5e2a9802002e5599a0876c62d86c716429a84dba4ff097c0e11ea99
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TM01840907[[fn=Equations]].dotx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WCRY
                                • Size 50KB
                                • SHA256 e73eaaff2963606d330a410f0dbaebd80a59ef7d10be945d3ace2f0bfe1af5c4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WCRY
                                • Size 46KB
                                • SHA256 0076462ff9b9e82b93056cc777c20bc3835ba351e315fc627c917bf32eadcc44
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TM03998158[[fn=Element]].dotx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WCRY
                                • Size 33KB
                                • SHA256 312d93bda3054249d185d178480b7432735cbf79a61c9563d916198ec65bb6f8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TM03998159[[fn=Insight]].dotx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WCRY
                                • Size 3.3MB
                                • SHA256 e06497af55c54a61374c02cad25087c1fef33b33143931c6090ce5057cd397ab
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Normal.dotm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.WCRY
                                • Size 18KB
                                • SHA256 a2604dd8c952af9f5a5a254a0b898da245e90374bff5a0c791a0f66a7f8d780c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CachedImage_1920_1080_POS4.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WCRY
                                • Size 76KB
                                • SHA256 6868dd123d2cc082b423f0b17541b47eeb1a0a5193acc44679bd8e220b3ce2f9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                prefs.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\c7ysk3c1.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.js.WCRY
                                • Size 776B
                                • SHA256 617d00314b4d7223038173ce71bbd3a40620d87350b03bcb77718fe0aa93230b
                                • MD5 SHA1 SHA512 TLSH

                                user.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\loemwbp3.Admin\user.js.WCRY
                                • Size 536B
                                • SHA256 0e857210ce56a61ffb6a71b438a6e4aa4f11da513c8a5adb25b90972bed43a55
                                • MD5 SHA1 SHA512 TLSH

                                cert9.db.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\cert9.db.WCRY
                                • Size 224KB
                                • SHA256 34514ab14a01c5744c4d77b301b1918ee128ff95dfeeaa70dc95965c99e1c9be
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                key4.db.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\key4.db.WCRY
                                • Size 288KB
                                • SHA256 ed4ed87e6d894678134a05691525247718f1fa400d4675ba5e29a9bc6c212359
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                pkcs11.txt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\pkcs11.txt.WCRY
                                • Size 808B
                                • SHA256 08d46411c2b7a90ef6a2797c3ec5a4bcbdea881e5e87a5e0ae0f18ceef368f65
                                • MD5 SHA1 SHA512 TLSH

                                prefs.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\sln8pgmh.default-release\prefs.js.WCRY
                                • Size 7KB
                                • SHA256 9a44634518cb1072c10d0f9d444958e251f8124663fe4b97658a6b5e6bae9af6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ProtectResume.mp4.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ProtectResume.mp4.WCRY
                                • Size 255KB
                                • SHA256 7cfe6a9e030d82db3ee5a175aad5e1877409929983a0bd4a27da5a5015b3f5cf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CloseUnprotect.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\CloseUnprotect.mp3.WCRY
                                • Size 566KB
                                • SHA256 f58bab52ec1c52c0bafab0fea13533393bdb57ea30ddd3e9613d0fc050075c04
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConfirmUninstall.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\ConfirmUninstall.bmp.WCRY
                                • Size 1.7MB
                                • SHA256 b6b5bb4ce082a698ffad9b651fbfd4e0cb1597a3a218ed06251da8442d99bbbf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertFromRestart.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\ConvertFromRestart.bmp.WCRY
                                • Size 653KB
                                • SHA256 3f685f65217b57e43e1cc6629c5e7076efd52a912957cfa3267146c3662bb8bf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertToSkip.xlsb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\ConvertToSkip.xlsb.WCRY
                                • Size 1001KB
                                • SHA256 7ed2ef9a37b3f162c3c4c9758133edbc94d4dbf089dcdc195b8b506093e1725a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ExitDebug.wmv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\ExitDebug.wmv.WCRY
                                • Size 827KB
                                • SHA256 ac376cac33ad532a34af3f90546082748bd77e97f64aba478c83694d8e7789a4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InstallConnect.xlt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\InstallConnect.xlt.WCRY
                                • Size 783KB
                                • SHA256 483b2e391dbf1a4c61d43dcfacc7403e926cab635a52ba88d85ba2c4a83f0831
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RemoveSave.dwg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\RemoveSave.dwg.WCRY
                                • Size 1.1MB
                                • SHA256 b4d62426a15d10dd437354b0ce3c7edbc2e2d57f2fe7e1b7b9dd1ea2b8dc9e8d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResizePublish.pps.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\ResizePublish.pps.WCRY
                                • Size 870KB
                                • SHA256 47b29d9a99ba9052fd847d44fca490b43c20f6dcea046a1598ae779f2c4d17df
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                TraceEnable.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PublishUnprotect\TraceEnable.gif.WCRY
                                • Size 1.1MB
                                • SHA256 a1a963d70aceae113cfe3fa383e86d82bb24423e06d966467ea9beea10cc5c89
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PushUpdate.dotm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\PushUpdate.dotm.WCRY
                                • Size 685KB
                                • SHA256 d7ec94422776add3cf0e41b81cc70dacf5296302ea9a1752ec7e9039b56e038b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AssertGrant.3gp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\AssertGrant.3gp.WCRY
                                • Size 1.5MB
                                • SHA256 f8de4ff069a8f6299e75b5dc68b5e268299654e2de67d1ec8a15b2f4e12f3c3e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EnableResolve.3gp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\EnableResolve.3gp.WCRY
                                • Size 1.9MB
                                • SHA256 ff8d2090726b9bd01484de6dd3fc64a4b27b776c6ed197c275e4a09958090697
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                FormatSend.mpeg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\FormatSend.mpeg.WCRY
                                • Size 1.8MB
                                • SHA256 faa103ce939b15ca6db3a82cecbdf8c684e6b1f723b7ff9c4f08f90c23ceb1f5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                NewMount.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\NewMount.jpg.WCRY
                                • Size 2.7MB
                                • SHA256 6219009c57d998b58882151b65ef0e59f853f211b7196645064312da4dc35a93
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestartPush.avi.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\RestartPush.avi.WCRY
                                • Size 1.2MB
                                • SHA256 dc77820dd5aaf9afb3faf2bae7914de64be954d65c806e0c9b050669f44a6e56
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                WriteDebug.doc.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ReceiveDisconnect\WriteDebug.doc.WCRY
                                • Size 1.4MB
                                • SHA256 50fae276f84af21494f14c8656d907fa0c3c69dcd33633def03c22cb137258a8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BlockClose.3g2.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\BlockClose.3g2.WCRY
                                • Size 217KB
                                • SHA256 61c8fc2227bc554deb75e1849b42bf7b07cf6a84b6770abe1a13c718e31afd62
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConnectDebug.bat.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\ConnectDebug.bat.WCRY
                                • Size 441KB
                                • SHA256 00211851b1d580ac00d69bb5d6561343cb0330c3c27aca10a9a96da7e88f98be
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EnterPush.csv.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\EnterPush.csv.WCRY
                                • Size 224KB
                                • SHA256 502ad8d97f5a4056ea204778052aa60d6d9b142130e5e199d4223f4ea1d65fcb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ExpandJoin.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\ExpandJoin.ps1.WCRY
                                • Size 161KB
                                • SHA256 f189347abec6a9316ad2a8a2960a4ee0ce6406f6e54c5e742c95e7c113db8d0f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MergeTrace.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\MergeTrace.bmp.WCRY
                                • Size 203KB
                                • SHA256 994f1ab8fa1816ff680b201aa16ea88b22163a7089ed18ed036fc6bdef27d307
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PopStep.xlsm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\PopStep.xlsm.WCRY
                                • Size 119KB
                                • SHA256 2cb4dd2acabab17ac065174db520bb5dd6f4fa9f815ed68592566b211e3f0e3a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SetResolve.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\SetResolve.jpg.WCRY
                                • Size 168KB
                                • SHA256 15d6da8cd0460e2ba675004231d31e30cb19a38886b3aee4c32faa98f6ccf241
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SkipConnect.xls.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\SkipConnect.xls.WCRY
                                • Size 133KB
                                • SHA256 411d3298d8d01c29446d1d64816cfe1065041e44450b2c86ba034448deb0b8b6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StopTrace.wma.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\StopTrace.wma.WCRY
                                • Size 112KB
                                • SHA256 163f4c8eebf87149a89db62d2e59f52845fba8cc89e944ac5013de7691cd06d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UninstallUnprotect.mp4.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameSync\UninstallUnprotect.mp4.WCRY
                                • Size 126KB
                                • SHA256 0f27b3d55174fe14c3b5684790af9cf075a46c7a84de252d2607c1f9a8bea938
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RenameUndo.bat.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RenameUndo.bat.WCRY
                                • Size 430KB
                                • SHA256 efbd181297a057eb08f31c416251837b646208c9427c4dde3ae309291fb2b24f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BlockPublish.vbs.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestInstall\BlockPublish.vbs.WCRY
                                • Size 556KB
                                • SHA256 f6f53241e98c285506fda34dc7a7ee87ac503ccbc10225eab82fdc8d3dbfffee
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterFind.wav.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestInstall\RegisterFind.wav.WCRY
                                • Size 632KB
                                • SHA256 23094e8a96476df990e004f58e9212c97328a1dc704c7651b229d33e96faa955
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResetAdd.wma.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestInstall\ResetAdd.wma.WCRY
                                • Size 328KB
                                • SHA256 51a275702aba99787e6ea50187b82f42a74f4ce2a3e509ae51aa3338b4a09ec6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestartCopy.png.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestInstall\RestartCopy.png.WCRY
                                • Size 303KB
                                • SHA256 c4132bb6299f183b1dafe4835e19d4854a32af908ba94aab5da5195a08e861f6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SuspendRename.php.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestInstall\SuspendRename.php.WCRY
                                • Size 885KB
                                • SHA256 c0b7f5300a209cee6240926ddd7a029516169a2e34a9b12bb062698a1732e12b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RequestSend.potx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RequestSend.potx.WCRY
                                • Size 322KB
                                • SHA256 9cb3e1e75600bb38f63b8a0a7b043ab134009e5fd8723ab3fdee97c87dea2327
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RestorePublish.zip.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\RestorePublish.zip.WCRY
                                • Size 470KB
                                • SHA256 384e05748b8b439408f5e6489d4f97583a641b009ef689853d2bb9afe63a2f54
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SetConvert.xlsb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\SetConvert.xlsb.WCRY
                                • Size 577KB
                                • SHA256 eef6c6dfa545991af68a4e4ca5ce010ac359efc258a4149a9b68ef646701fd45
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CloseInitialize.bmp.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\CloseInitialize.bmp.WCRY
                                • Size 508KB
                                • SHA256 528b9e4b2360d016e826e4d2d4279a304b4598337b8d3c45057fb04580397b2d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConnectSplit.jpg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\ConnectSplit.jpg.WCRY
                                • Size 277KB
                                • SHA256 d7335fee293a796c31dacccafa678e0691e6bc8bff446e2fb0351dd5868492b8
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConnectUnlock.mpeg.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\ConnectUnlock.mpeg.WCRY
                                • Size 624KB
                                • SHA256 5b7eb330781cf7a4fc3dbc7a3aa34929bdc433862fa7025fde86fc6a76038607
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                LimitUninstall.zip.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\LimitUninstall.zip.WCRY
                                • Size 462KB
                                • SHA256 2e853c92105d8f3bbe4b5dd2079328ec2adda55b500da907930c634d2509b785
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MountMeasure.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\MountMeasure.mp3.WCRY
                                • Size 485KB
                                • SHA256 52585ea71c351c93858dc44fc15b84b0b8fd44f30fa5eec9ea3bdbbfc0868632
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenRequest.doc.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\OpenRequest.doc.WCRY
                                • Size 416KB
                                • SHA256 29b788fc660cf864628274a348449282f83be7a97839df2416636415ffe3778a
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RequestClear.docx.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\RequestClear.docx.WCRY
                                • Size 1.1MB
                                • SHA256 d365f3a19036b28f1015e89aa098687595ba5baa4e153675e68a7c2cfb412f73
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ResizeOut.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\ResizeOut.ps1.WCRY
                                • Size 670KB
                                • SHA256 940760326e5eb3fc67c97c6215d2aba2a86fbdfd5d2b5580fdb534dea58a2bb6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StartUnprotect.tiff.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\StartUnprotect.tiff.WCRY
                                • Size 393KB
                                • SHA256 cb302a60353fd56e6c366f8051c748b49410639791c807c15c5db57a26a82ec7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnblockWrite.dotm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\ShowRedo\UnblockWrite.dotm.WCRY
                                • Size 346KB
                                • SHA256 81221d951932126de6e451e98169b9446cd4acbadf6a237378a8cbcb7dafefe4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UndoSet.ps1.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UndoSet.ps1.WCRY
                                • Size 295KB
                                • SHA256 879d775831aa8179a412ce8c6bceae0ab61c51c60b82288dba18d7808eae231d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UndoStep.png.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UndoStep.png.WCRY
                                • Size 631KB
                                • SHA256 7ff132c6cbe0a4deaa8d8bec841b0a56b4d8ec58c601f2240e96b6abc61356b9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnpublishRestart.docm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UnpublishRestart.docm.WCRY
                                • Size 416KB
                                • SHA256 6edf256f92308c56245551159172810e18b655aa163b0fe588878aaf50b53dc5
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnregisterCopy.odt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UnregisterCopy.odt.WCRY
                                • Size 698KB
                                • SHA256 7d2ee179ce26639d3aa5f638d021b2923f1c3ea970817181d21111b7c1ac2e51
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CheckpointSwitch.xlt.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\CheckpointSwitch.xlt.WCRY
                                • Size 770KB
                                • SHA256 1dd13b50f185dc750f8cd77385591e6d042d2903c183d2ca9fd263a710286703
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompareHide.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\CompareHide.gif.WCRY
                                • Size 1.1MB
                                • SHA256 e2cc41fb4b501f37fa4248d34c573c39a47b97252324f9532e1a4f37dc8faaa4
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConvertFromInitialize.wma.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\ConvertFromInitialize.wma.WCRY
                                • Size 753KB
                                • SHA256 05b0a054ae5c97f80636413e0cba76347e9399214094d3023663b0bf0448d6ab
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GrantDebug.potm.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\GrantDebug.potm.WCRY
                                • Size 567KB
                                • SHA256 476ba3d4f111ff6e8b8b1ab16d2e6c3923135c1f13f757b4fa85f3de30f22275
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeApprove.gif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\InvokeApprove.gif.WCRY
                                • Size 330KB
                                • SHA256 4d73363a73e0f548498c3e2b4591411dabedfa20a65da9381d0ea19fc5f157e2
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MoveConvertTo.asf.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\MoveConvertTo.asf.WCRY
                                • Size 634KB
                                • SHA256 cb96f0e2b5424d5b24caeced2d446c299f8e0d096a1d4084320c29b241b46a42
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenInstall.xls.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\OpenInstall.xls.WCRY
                                • Size 381KB
                                • SHA256 76b2e309c06462e61d8baadebe68ee4fdba56672751d87fd0efe67dddbdd8e5b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OpenPush.php.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\OpenPush.php.WCRY
                                • Size 482KB
                                • SHA256 1efb845abb969a5b99e8057a519a77233abb75ca19a2db77c3cbcfcd168c2dfb
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                OptimizeEdit.js.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\OptimizeEdit.js.WCRY
                                • Size 702KB
                                • SHA256 bdd69dd32d1d750fe161c6f0be78574553fe6d0c48d558f14d677fc14b67b260
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ProtectSearch.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\ProtectSearch.tif.WCRY
                                • Size 448KB
                                • SHA256 7028f2ad8d55e8284925e8778b3806185d2e84dbb98e5784a823b21752f7b6e9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                PushRedo.xlsb.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\PushRedo.xlsb.WCRY
                                • Size 364KB
                                • SHA256 4e680793f31534435f69edef13712e93f7a6da6f5cb1195c357863e097572a65
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnblockUnprotect.avi.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\UnblockUnprotect.avi.WCRY
                                • Size 414KB
                                • SHA256 23d126a3efab4b5bf57a2d126ea1370c73e857fa0745ca7e77295815ac7187de
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnprotectFind.mp3.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\UnprotectFind.mp3.WCRY
                                • Size 601KB
                                • SHA256 33b1d5f1850b0b8f922d8edd9e555dbcb3699619e2a0a7cdb24cc30fc86fea31
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnprotectRevoke.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\UnprotectRevoke.tif.WCRY
                                • Size 499KB
                                • SHA256 38c2d9e86b0caa6293bf63e2c2c04fa823d9994a33524fab6dcba3e53f499ece
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UseDisconnect.tif.WCRY

                                • Path C:\Users\Admin\AppData\Roaming\UseWatch\UseDisconnect.tif.WCRY
                                • Size 787KB
                                • SHA256 44416c5c060b7367bc51c2f503bfc9859f2b4ae6714d10371eacaa3bb704833d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConnectResize.docx.WCRY

                                • Path C:\Users\Admin\Desktop\ConnectResize.docx.WCRY
                                • Size 18KB
                                • SHA256 745f46baa77d71d92870f6119bcbfedc7aefa4d473b66bc7f9e6ccd1f946f757
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DisableSwitch.docx.WCRY

                                • Path C:\Users\Admin\Desktop\DisableSwitch.docx.WCRY
                                • Size 19KB
                                • SHA256 739e578b94038083a6c629967bae56053e2b89ecfe99fa15e26d17fb698a5ad3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GrantPublish.cmd.WCRY

                                • Path C:\Users\Admin\Desktop\GrantPublish.cmd.WCRY
                                • Size 528KB
                                • SHA256 c3358e81698ca96d04e9c89ec1cb66069e9d9bbc2d185d0f48dd8485c1f77cdf
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ReadReceive.ps1.WCRY

                                • Path C:\Users\Admin\Desktop\ReadReceive.ps1.WCRY
                                • Size 1.2MB
                                • SHA256 3329668e60c5a7919b458703fd7eceaab27373597b97402ba21176308be4efb7
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RegisterSwitch.pps.WCRY

                                • Path C:\Users\Admin\Desktop\RegisterSwitch.pps.WCRY
                                • Size 745KB
                                • SHA256 0ae21bbc56157497daa64a419b4ff3f3cbf9d7aa964cbb2394c35dc8d7d93d8b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RemoveMerge.wmv.WCRY

                                • Path C:\Users\Admin\Desktop\RemoveMerge.wmv.WCRY
                                • Size 691KB
                                • SHA256 729590cec5bc06475448e840a0f2fbbc57bb9ff8d2b9e1141fea6e309c9f77c0
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RenameLock.mp4.WCRY

                                • Path C:\Users\Admin\Desktop\RenameLock.mp4.WCRY
                                • Size 447KB
                                • SHA256 5f3b66aeb15e0eaac2618ef4c9b6c4dcf1ecf1bc057f81edfdf2773db2c25fae
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SendLimit.xlsx.WCRY

                                • Path C:\Users\Admin\Desktop\SendLimit.xlsx.WCRY
                                • Size 11KB
                                • SHA256 ae470d7a0be1ba64aedb58d770697737f72dc1007aa3b047e51f2def8d6caf51
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SetUnregister.avi.WCRY

                                • Path C:\Users\Admin\Desktop\SetUnregister.avi.WCRY
                                • Size 826KB
                                • SHA256 ffc5fe7cc887b80657be667ff4d61ae26259ecbc191f1babbd6468a73a102928
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UndoImport.tif.WCRY

                                • Path C:\Users\Admin\Desktop\UndoImport.tif.WCRY
                                • Size 501KB
                                • SHA256 2e739f732cb8f754ed9e16a42a0b9a75fe02e371fa78a92593237afbd0706687
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                AddBackup.ppsx.WCRY

                                • Path C:\Users\Admin\Documents\AddBackup.ppsx.WCRY
                                • Size 800KB
                                • SHA256 7316b8ecfe0ba4972e7078a2cf4f58eadf4dcae92cfc8f306b664ecc9939b686
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                BackupWatch.odp.WCRY

                                • Path C:\Users\Admin\Documents\BackupWatch.odp.WCRY
                                • Size 1.2MB
                                • SHA256 ab36f72fe6aa9498ad3aa63b60624e74f0fc32fc799782b152ed6e2383c4615e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompleteUnblock.docx.WCRY

                                • Path C:\Users\Admin\Documents\CompleteUnblock.docx.WCRY
                                • Size 13KB
                                • SHA256 f26e9e5ab05d6686bdd0638689498b1192723ad54e7f8706373fa3c156177388
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                DismountAssert.potx.WCRY

                                • Path C:\Users\Admin\Documents\DismountAssert.potx.WCRY
                                • Size 1.3MB
                                • SHA256 47c5476cddfac46fd1673a837fec73b4e5d9af858095a4d91f0f1ec1f23c00c6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GetConvertTo.csv.WCRY

                                • Path C:\Users\Admin\Documents\GetConvertTo.csv.WCRY
                                • Size 1.2MB
                                • SHA256 74a461ff499b2556ece5eae3b1caae17659f0ab05676e0c2cc35761614c952e6
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                GrantRead.odp.WCRY

                                • Path C:\Users\Admin\Documents\GrantRead.odp.WCRY
                                • Size 977KB
                                • SHA256 da6d004ba71143e302e5f8cf2f5a277de929f56deb03227c1cd98e028550ac5d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                InvokeSave.xls.WCRY

                                • Path C:\Users\Admin\Documents\InvokeSave.xls.WCRY
                                • Size 1.3MB
                                • SHA256 effa56037890de4ed2fbdaba09b2e37e8da30e7d199116cb5e95f5a7a4fe0739
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                MoveRename.csv.WCRY

                                • Path C:\Users\Admin\Documents\MoveRename.csv.WCRY
                                • Size 1.9MB
                                • SHA256 e5922e2b99d579ffa6bf0a45fa0141af56dc26dbed683558762599f8c65fc1fe
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Open Notebook.onetoc2.WCRY

                                • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WCRY
                                • Size 6KB
                                • SHA256 15d9e3335673d19df116c4c80fe4a09b3789695582fdede9396f9e8b74db1990
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Outlook Data File - rexqjukgzb.pst.WCRY

                                • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - rexqjukgzb.pst.WCRY
                                • Size 265KB
                                • SHA256 1fd3c39e6b7e504eaac890212317fbdb5c430c590fd1bca640349e27e0eef767
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ReadRestart.pdf.WCRY

                                • Path C:\Users\Admin\Documents\ReadRestart.pdf.WCRY
                                • Size 711KB
                                • SHA256 bba938f854665833221767dd28bd9a395bf3ce66b9d7366fbfced487b290ef72
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SaveWatch.xlsx.WCRY

                                • Path C:\Users\Admin\Documents\SaveWatch.xlsx.WCRY
                                • Size 14KB
                                • SHA256 0b1cf4a96256d5d9d4ff70828d1ae789dce51b309a3aa5ae5a76677ab9be9a4f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SelectNew.docm.WCRY

                                • Path C:\Users\Admin\Documents\SelectNew.docm.WCRY
                                • Size 533KB
                                • SHA256 9c49020a5bc61cd07953bee1fd58b27c4f97f6f511f6c1d2b5fd4b8d4fd7aec3
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ShowSplit.potx.WCRY

                                • Path C:\Users\Admin\Documents\ShowSplit.potx.WCRY
                                • Size 577KB
                                • SHA256 35819eba12a9ed1ee48b198f3341735c9f6b161ccfb0d7de2c7f3502d2e33251
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                StepExpand.xls.WCRY

                                • Path C:\Users\Admin\Documents\StepExpand.xls.WCRY
                                • Size 622KB
                                • SHA256 6ede8eb651cd1af31523bdc110697ec7cdd929c3e0ccaaf60640a637f79ecf7d
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SubmitClose.xlsx.WCRY

                                • Path C:\Users\Admin\Documents\SubmitClose.xlsx.WCRY
                                • Size 11KB
                                • SHA256 71c90f105d8ef41ba1e49ecbf822d2f08337bfc6bc1a2e71ec5dbf036b4fe948
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnlockSwitch.csv.WCRY

                                • Path C:\Users\Admin\Documents\UnlockSwitch.csv.WCRY
                                • Size 1022KB
                                • SHA256 a5502da8b00d2d86ab83278b1e063bbfe7b942b6aef8868b3f437b88ecd745fa
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnlockUnpublish.xlsx.WCRY

                                • Path C:\Users\Admin\Documents\UnlockUnpublish.xlsx.WCRY
                                • Size 14KB
                                • SHA256 f60a912f36f9f537a97c25cad9438a1e2dc1ae2190cd9ffac1f947f42e3bb957
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UseUninstall.xlsx.WCRY

                                • Path C:\Users\Admin\Documents\UseUninstall.xlsx.WCRY
                                • Size 13KB
                                • SHA256 90d89775e09b8b2b9e92cef52a9449a7ca3abf9b25ce93aa7c77005a6cb7b87b
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                !WannaDecryptor!.exe.lnk

                                • Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
                                • Size 590B
                                • SHA256 1267e6128ab85020ec48f259176323546cdc19001023ebeef971d873311ee5f2
                                • MD5 SHA1 SHA512 TLSH

                                00000000.res

                                • Path C:\Users\Admin\Downloads\00000000.res
                                • Size 136B
                                • SHA256 35efdae42d307072c411793783e46e272626e7239fb72612f4ddf0cb4e83eb39
                                • MD5 SHA1 SHA512

                                00000000.res

                                • Path C:\Users\Admin\Downloads\00000000.res
                                • Size 136B
                                • SHA256 4d5cd607c8bc29f268efc2c23cff8d2028f40dfe97729306bfb547cb96a0ddc3
                                • MD5 SHA1 SHA512

                                149911793822642.bat

                                • Path C:\Users\Admin\Downloads\149911793822642.bat
                                • Size 318B
                                • SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
                                • MD5 SHA1 SHA512 TLSH

                                33377967-c946-40da-806e-9ba0c5d2849c.tmp

                                • Path C:\Users\Admin\Downloads\33377967-c946-40da-806e-9ba0c5d2849c.tmp
                                • Size 5KB
                                • SHA256 a53eaf4a34306ef98568e1a3d558201e3f94d6af07e278cb440530a5cd944d96
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                Unconfirmed 406942.crdownload

                                • Path C:\Users\Admin\Downloads\Unconfirmed 406942.crdownload
                                • Size 224KB
                                • SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                c.vbs

                                • Path C:\Users\Admin\Downloads\c.vbs
                                • Size 201B
                                • SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
                                • MD5 SHA1 SHA512 TLSH

                                c.wry

                                • Path C:\Users\Admin\Downloads\c.wry
                                • Size 628B
                                • SHA256 47948ed6147f148b2981c7bf8638e92beae464b4dc2cd447386069cdfaa18f8f
                                • MD5 SHA1 SHA512 TLSH

                                c.wry

                                • Path C:\Users\Admin\Downloads\c.wry
                                • Size 628B
                                • SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
                                • MD5 SHA1 SHA512 TLSH

                                m.wry

                                • Path C:\Users\Admin\Downloads\m.wry
                                • Size 42KB
                                • SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                r.wry

                                • Path C:\Users\Admin\Downloads\r.wry
                                • Size 729B
                                • SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
                                • MD5 SHA1 SHA512 TLSH

                                t.wry

                                • Path C:\Users\Admin\Downloads\t.wry
                                • Size 68KB
                                • SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                u.wry

                                • Path C:\Users\Admin\Downloads\u.wry
                                • Size 236KB
                                • SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                CompressPing.xls.WCRY

                                • Path C:\Users\Admin\Music\CompressPing.xls.WCRY
                                • Size 1.3MB
                                • SHA256 f91d7abeb0c5e0aa07ca63415ad20ecd974ce769a2009a3c69b5d03d00230b98
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                EditCompress.mp4.WCRY

                                • Path C:\Users\Admin\Music\EditCompress.mp4.WCRY
                                • Size 954KB
                                • SHA256 ea5d90c34474cfcf9d7d270f20ba3253081e7fb06780273a9eb6e5bed1e93aac
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnblockDebug.ppsm.WCRY

                                • Path C:\Users\Admin\Music\UnblockDebug.ppsm.WCRY
                                • Size 681KB
                                • SHA256 e6f378bf543a6f54dcf6494cb56a236535527453cd90e999c50f99e3ddd65b93
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                UnregisterCopy.odt.WCRY

                                • Path C:\Users\Admin\Music\UnregisterCopy.odt.WCRY
                                • Size 900KB
                                • SHA256 882911616523ce28a1aa282299005ebeabbdab49c14f5b6a2842a971d8f90809
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ConfirmStep.bmp.WCRY

                                • Path C:\Users\Admin\Pictures\ConfirmStep.bmp.WCRY
                                • Size 370KB
                                • SHA256 ac0ee406b33c38a578f07b2ff526dfad5f0ea574e985f5bb7db4a38d14954d52
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                ImportDeny.jpg.WCRY

                                • Path C:\Users\Admin\Pictures\ImportDeny.jpg.WCRY
                                • Size 1.0MB
                                • SHA256 3621efd515e0530644d7a0efec34cb9e1cb69e17e06940ca3d22b2a763fa3a2e
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                RevokeExport.png.WCRY

                                • Path C:\Users\Admin\Pictures\RevokeExport.png.WCRY
                                • Size 657KB
                                • SHA256 7f008d617ad29840d1d5ee01ac6761054290de2435d6b7489368b0d77112eb6c
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                SplitLock.jpeg.WCRY

                                • Path C:\Users\Admin\Pictures\SplitLock.jpeg.WCRY
                                • Size 616KB
                                • SHA256 96073a4c74ac6fe2833d2ece8fd5503b78ff7e2d55879ce4ab1c35e55340e827
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                kBNPKDw.jpg.WCRY

                                • Path C:\Users\Admin\Pictures\kBNPKDw.jpg.WCRY
                                • Size 24KB
                                • SHA256 3cc8ce97eea41392cf2a7517b5d599631a2b9fe7df24efefcb50147fef57a97f
                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                memory/2904-63-0x0000000010000000-0x0000000010012000-memory.dmp