Resubmissions

14/11/2026, 20:41

261114-zgjvqsdv7w10

14/11/2026, 19:28

261114-x63m2ags7m10

14/11/2026, 15:24

261114-stchvsas5z10

14/11/2026, 11:11

261114-nabd8sfz6110

14/11/2026, 10:58

261114-m2ys6sfy8y10

14/11/2026, 03:29

261114-d2dnkacs5y10

13/11/2026, 20:35

261113-zdasna1y2p10

Analysis

  • max time kernel
    118s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    14/11/2026, 15:24

General

  • Target
    WannaCry.exe
  • Size 3.4MB
  • Sample261114-stchvsas5z
  • SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Path
  • wannacry

Ransom Note
  • Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets
  • 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Family: Wannacry

    WannaCry is a ransomware cryptoworm.

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 14 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound 2 IoCs

    Network activity triggered a Suricata alert

  • Adds Run key to start application 2 TTPs 1 IoCs
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
    "C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
    1⤵
    • Creates a file in the Startup directory
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h .
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:4508
    • C:\Windows\SysWOW64\icacls.exe
      icacls . /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:2396
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2900
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 6741794669899.bat
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\cscript.exe
        cscript.exe //nologo m.vbs
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:3484
    • C:\Windows\SysWOW64\attrib.exe
      attrib +h +s F:\$RECYCLE
      2⤵
      • System Location Discovery: System Language Discovery
      • Views/modifies file attributes
      PID:5136
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:6756
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:7028
      • C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        TaskData\Tor\taskhsvc.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4008
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b @[email protected] vs
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6768
      • C:\Users\Admin\AppData\Local\Temp\@[email protected]
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:6832
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5552
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic shadowcopy delete
            5⤵
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:3308
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:5888
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3788
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4760
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "brezznqd118" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\SysWOW64\reg.exe
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "brezznqd118" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3784
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:2008
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:688
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3504
    • C:\Users\Admin\AppData\Local\Temp\taskse.exe
      taskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3524
    • C:\Users\Admin\AppData\Local\Temp\@[email protected]
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1196
    • C:\Users\Admin\AppData\Local\Temp\taskdl.exe
      taskdl.exe
      2⤵
      • Executes dropped EXE
      PID:1432
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OfficeIntegrator.ps1.WNCRY

        • Path C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRY
        • Size 5KB
        • SHA256 acd7dc4e86ec88c4ea8930556df32576ea89286a5046f500650826de103ccc4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stream.x64.en-us.db.WNCRY

        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\1D246D71-33CB-4DCD-BBC8-53D007A9DD62\en-us.16\stream.x64.en-us.db.WNCRY
        • Size 438KB
        • SHA256 326f10a8efe6cd21a78ce8e98be9fe623c202c4b5b182b42e72cb04f747f4cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stream.x64.x-none.db.WNCRY

        • Path C:\ProgramData\Microsoft\ClickToRun\ProductReleases\1D246D71-33CB-4DCD-BBC8-53D007A9DD62\x-none.16\stream.x64.x-none.db.WNCRY
        • Size 1.8MB
        • SHA256 eea78f8262d01412d388a5ce43164e3be817cbd600ea88fa4c854cb32e086a99
        • MD5 SHA1 SHA512 SSDEEP TLSH

        background.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRY
        • Size 126KB
        • SHA256 9d00f780924f2bf5a0a9797089f3755178056b54200001a8f581b4f00ba999ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        device.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRY
        • Size 43KB
        • SHA256 065dce6895ae3dc9a41d3398a161ee0386c86d434f16c36fb6625d8334708557
        • MD5 SHA1 SHA512 SSDEEP TLSH

        overlay.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRY
        • Size 28KB
        • SHA256 35fbb2ba2586420a6c66a6965e8573592f192751e8e266b2a5b7c5d935356a07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        superbar.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRY
        • Size 38KB
        • SHA256 5ef48b7ee67f5d7c9c1946971c74dee2ba26e79f303d2d8369f02379ea589fba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        background.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRY
        • Size 126KB
        • SHA256 4036a002ab948e16c5498cf42a4fbfc83ecb62e0c8506c37a15c2d4855a59d10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        watermark.png.WNCRY

        • Path C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRY
        • Size 28KB
        • SHA256 62939ef1360954dca49c50db7f23596b284eb29a43700c422d075b79434ea89e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EventStore.db.WNCRY

        • Path C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRY
        • Size 56KB
        • SHA256 e17185849145b3a50a351c81134d8be76fe9d2342eca31273620e12b14deca3d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EventStore.db.WNCRY

        • Path C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRY
        • Size 32KB
        • SHA256 ae030a3e8749cb509095bf3ab4131fd90a75d619a0a31be12e5471547daaaf5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EventStore.db.WNCRY

        • Path C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRY
        • Size 20KB
        • SHA256 e088fbe37016fa81ff559624e55ee16eef10a3ccfb43a0a85a1c9233a0213179
        • MD5 SHA1 SHA512 SSDEEP TLSH

        osver.txt.WNCRY

        • Path C:\ProgramData\Microsoft\Diagnosis\osver.txt.WNCRY
        • Size 296B
        • SHA256 f4fafe5a4d81f8a01a1d3e6e6c5532e27618004706bda6f0cb4bafcfefd4c418
        • MD5 SHA1 SHA512 TLSH

        qmgr.db.WNCRY

        • Path C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WNCRY
        • Size 1.5MB
        • SHA256 525c7fad313187ed57d7956f308113054d7c4ac15a559404570c35381f67098f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Windows.edb.WNCRY

        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRY
        • Size 8.0MB
        • SHA256 4b6c4205b57142c5bc251f5565396817fa1560ffc63c8689a94405856ca6eb54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SmsInterceptStore.db.WNCRY

        • Path C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRY
        • Size 192KB
        • SHA256 1bf3029436eccd2554526a64450532d1ce8dff59da0b60e70dbac3a50a8ba060
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterInboxTemplates.ps1.WNCRY

        • Path C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRY
        • Size 904B
        • SHA256 27d0ec4f4a2b36711cdd7cced47c5c458c4087fc8699036eae78a4fa41000c86
        • MD5 SHA1 SHA512 TLSH

        guest.bmp.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRY
        • Size 588KB
        • SHA256 d05f7d947f1a339a95fb3bf0902e4b5a595f0fa2d50e4e74f1310c56c0e1a067
        • MD5 SHA1 SHA512 SSDEEP TLSH

        guest.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRY
        • Size 6KB
        • SHA256 40af4384a1a2ed3dc10ef13c3662a567d870948c09aff5d6f9fa45b60cf4f4f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user-192.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRY
        • Size 2KB
        • SHA256 e4ee63a2efed5defc025ce8b9bc3d74b37c9c16c91142327889a328cdbad7291
        • MD5 SHA1 SHA512 TLSH

        user-32.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WNCRY
        • Size 728B
        • SHA256 b94361937457172925c4b4bd973aa69ff39bf830975932bd3edb0e8b8c932e76
        • MD5 SHA1 SHA512 TLSH

        user-40.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WNCRY
        • Size 808B
        • SHA256 fd85911236e73636d1e18326e9caa048e9b9dafb8525cb37b85748483d450881
        • MD5 SHA1 SHA512 TLSH

        user-48.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WNCRY
        • Size 904B
        • SHA256 7468e732b18f02fc069ef74016db626c7523e98fe0c601034a6fb83c0bb90df3
        • MD5 SHA1 SHA512 TLSH

        user.bmp.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRY
        • Size 588KB
        • SHA256 bc41d30f8d4e2e8e1f1f5bc2736dfc5698cc77afe6617e2677b7b1dbdef35af7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user.png.WNCRY

        • Path C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRY
        • Size 6KB
        • SHA256 c058d9a39230902c6bce9ea4fcc7f7a6346d2ccf1c80b2522870d6e993bdd3c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\de-DE\WelcomeFax.tif.WNCRY
        • Size 99KB
        • SHA256 93b5f7375fe822f830ba646f1158671790d531322270990b8e38bf608b8dc579
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRY
        • Size 87KB
        • SHA256 7c3628ff1de25811ac45f97090c8fe4f9667ac012081027ac0a9cbdcbcf8aaaf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\es-ES\WelcomeFax.tif.WNCRY
        • Size 94KB
        • SHA256 2d9bb90c178bb11a9d0cfd7c2abe69ed430410be1a1bafbef28262b22bf7680b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\fr-FR\WelcomeFax.tif.WNCRY
        • Size 101KB
        • SHA256 95710b8a5252878123a067d19b17be8976bdca7179a3dd19dd70f4f205055c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\it-IT\WelcomeFax.tif.WNCRY
        • Size 92KB
        • SHA256 0b54b2bc6989db3d4caf5684df0e0cdcb2fe750d46bf702fe85b5956b19fc00a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\ja-JP\WelcomeFax.tif.WNCRY
        • Size 77KB
        • SHA256 88eedd108e04781180ed139d84eac145759184dab4ca11d66d6f4d718c354359
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeFax.tif.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\uk-UA\WelcomeFax.tif.WNCRY
        • Size 105KB
        • SHA256 b97dc601eaede7115d5f28a9dba45ea92bb37a9cf2ebef57f42173832213d5ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WelcomeScan.jpg.WNCRY

        • Path C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY
        • Size 504KB
        • SHA256 34ae022afdeddb05403ee830b0835618d3690ab419c5d00db792d4d0a81e2657
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cversions.2.db.WNCRY

        • Path C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRY
        • Size 16KB
        • SHA256 010ab0cc3dc520864fdab045eb9ed8e7c5cc6a4a3603516f6860902ea326b9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRY

        • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRY
        • Size 289KB
        • SHA256 2b9ce271e06393c97c1763a9926042e94469bb6ce3b7c077e4e412c01ec21f50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRY

        • Path C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRY
        • Size 289KB
        • SHA256 ef40c700757b2074943d275a2c2474ef00624249f4dd25882399f4f3361b6b77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {71FD6E77-D9A5-4E49-8BCA-A3432229C339}.2.ver0x0000000000000001.db.WNCRY

        • Path C:\ProgramData\Microsoft\Windows\Caches\{71FD6E77-D9A5-4E49-8BCA-A3432229C339}.2.ver0x0000000000000001.db.WNCRY
        • Size 1KB
        • SHA256 9460ee4fcd3dd79706f377b9ed6b93399481ad619605728e08f1ab4bb153b7ee
        • MD5 SHA1 SHA512 TLSH

        {DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY

        • Path C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRY
        • Size 623KB
        • SHA256 b4f55136c6c199df7151ff59a6e60eebeefb5c557ff7c0f95970e13da9a67c74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ActivitiesCache.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\L.Admin\ActivitiesCache.db.WNCRY
        • Size 1.0MB
        • SHA256 052325ac556cf51ba64211180da7a64fb6346915320d9c16f2a21913383c0b9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\128.png.WNCRY
        • Size 5KB
        • SHA256 86cdd751367611893719eec1ae4357178a86d129d1db628ef003b034b13c0376
        • MD5 SHA1 SHA512 SSDEEP TLSH

        offscreendocument_main.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\offscreendocument_main.js.WNCRY
        • Size 130KB
        • SHA256 1627d442d46959034ea4416b160f3f28d114643b79cbc071312c0aa89b0b7b89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        page_embed_script.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\page_embed_script.js.WNCRY
        • Size 632B
        • SHA256 f471a77f5a26446afb93a0d0476ea9985c6fc295055db99552967cc49c591ebe
        • MD5 SHA1 SHA512 TLSH

        service_worker_bin_prod.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\service_worker_bin_prod.js.WNCRY
        • Size 136KB
        • SHA256 20656036b9add034b2a3bd0620e8b5c4fb8cff683083650c0488240a88a1c63d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        craw_background.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRY
        • Size 532KB
        • SHA256 46347ccaa36d4d79bb52edcc566cda8c03cea2cf836706d4f06a033c6b2e2b5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        craw_window.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRY
        • Size 255KB
        • SHA256 aeb10d9187ee7d0bc876a6ba33422444ea182a72f3bb930cb48def8715aadc67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        flapper.gif.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRY
        • Size 68KB
        • SHA256 6beebd4232b43070d4b6986720b112bc975114b4a5d01c0a3a1af87047f795b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon_128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRY
        • Size 4KB
        • SHA256 db0a082a4b2ef56df9324468d8b4d21e11a0a57ba56d060198beef159fad61e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icon_16.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png.WNCRY
        • Size 872B
        • SHA256 5fb2522432a3fad17c65878ad2fa6ff03113a57309a3d6312b82902934080e51
        • MD5 SHA1 SHA512 TLSH

        topbar_floating_button.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png.WNCRY
        • Size 440B
        • SHA256 695a95e3e4223eea86a855201ffb974d5e17ba8e8a4a01daad0ffd95fa794762
        • MD5 SHA1 SHA512 TLSH

        topbar_floating_button_close.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png.WNCRY
        • Size 536B
        • SHA256 43c88a55e879773db36804bf386a80117e4ffe3c497ea7bbae18a9263462165f
        • MD5 SHA1 SHA512 TLSH

        topbar_floating_button_hover.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WNCRY
        • Size 440B
        • SHA256 bf7798d850794a5d0336c48077124163769346cf13ef49d5e89f9cc3afcc2b32
        • MD5 SHA1 SHA512 TLSH

        topbar_floating_button_maximize.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png.WNCRY
        • Size 456B
        • SHA256 3f4792c8c372bcd9c27b5b3c8c1eedef4d6ba2da23e3b280cf5bf3459d275876
        • MD5 SHA1 SHA512 TLSH

        topbar_floating_button_pressed.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png.WNCRY
        • Size 440B
        • SHA256 bb55f732e4b1cc6a9be37f787dba7e334a5130e6baed166b412162532dc59cda
        • MD5 SHA1 SHA512 TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRY
        • Size 8KB
        • SHA256 1407c834b97a8fcad6606a20308eb2cd4892b452fff613250e11a6e4e1346cba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRY
        • Size 5KB
        • SHA256 0885aa46d1eb835897e59ad9c07fc912d2d67db625be3aa823d50c5edf59ff21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRY
        • Size 20KB
        • SHA256 23d9bded6b2f8e95d004c1c67913520b71d369abcef2622efba44252f499b6f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRY
        • Size 2KB
        • SHA256 f708d9ac0a1330352d60b117d8dd16fdf07fce85bb5282d59fafd990d73afdab
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRY
        • Size 3KB
        • SHA256 5756154beb2a959b10a36263e52d63feae75079efef8abd2cbc9dc9c435e9010
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRY
        • Size 4KB
        • SHA256 68701b91b5c3a4b355f5605e80b94a57779f00b9f91677c19dd76f1820ef7c8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRY
        • Size 6KB
        • SHA256 c6b35d2b66c6f2c3c243da105096148697430b2fed5574aaac61aae4158e2ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRY
        • Size 10KB
        • SHA256 9f400cfbbb9c7f6a518ece14101282a5141a415f5387b38ab288f7c606dcef95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRY
        • Size 7KB
        • SHA256 3e8a37e8948801f53509d60e4db18688ff5557f26a7fe69d94ee63c0bd966fef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRY
        • Size 26KB
        • SHA256 c60a2f293f5c3f95970b68a6cd61c144b70c7b3b637b3b740fddd8dc468fd49a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 1ffa1286cd064e34186399237807c5ea1d454f69eaca22b6243166f5a5938f38
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRY
        • Size 2KB
        • SHA256 451740004d47ad5fb1d15f38221ce683b9e1526312ac5f59daa27ab13b9f817f
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRY
        • Size 4KB
        • SHA256 9ddaa10ce47169956b57bfae0fce4baf304a9ee1b6451e196ec98de62d6e8f1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRY
        • Size 7KB
        • SHA256 5cefe6bcdf9cd671f25bef1a94ffb641b39c51ea2ebbab5fff824c05584861c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRY
        • Size 2KB
        • SHA256 7e0aa9107662889b6ae279ab7f4c36ea2e0f98d84b7bf845f3f15870148a39a5
        • MD5 SHA1 SHA512 TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRY
        • Size 1KB
        • SHA256 047f9824a748f1da2bb381b5b5656f7c9a4d7cc274d10a1275f031c92f81220b
        • MD5 SHA1 SHA512 TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRY
        • Size 5KB
        • SHA256 fa0fa2aed6e07e2034bcdbfe172e381f9c14aa1026475e144c12fb203dc66d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 1f5fe86c82a0eb9e5bf24b199c54eeb3a0854e536f10915d34aae59e52c36f69
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WNCRY
        • Size 1KB
        • SHA256 92f85a3b5ff77a7aaa8c80e5d093ebb4e20d4b2222ff5daf43a5b12a8bdbf7f3
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WNCRY
        • Size 1KB
        • SHA256 94a9431dc945ef5ee11d1343ee6772a407bd3709bc77308155b12473b82b408e
        • MD5 SHA1 SHA512 TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WNCRY
        • Size 2KB
        • SHA256 f42de508ce7305c7a98e2474ec5a3e615cb461c9c00588e13d05bb8779eda541
        • MD5 SHA1 SHA512 TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WNCRY
        • Size 5KB
        • SHA256 e32f1fd1f8d0bff79c38d0080e60a2be8970fecc17a210991e9deff8aaa67251
        • MD5 SHA1 SHA512 SSDEEP TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WNCRY
        • Size 3KB
        • SHA256 d3ccdb2a8dacb189811e0206f899b5d0d2401caa1928483735230d8f7687e3db
        • MD5 SHA1 SHA512 TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WNCRY
        • Size 13KB
        • SHA256 33c1051660db51540638597d870b5b54c3ff61aacdaeca1d7364a1f302a5b308
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 e310dd3f9236102b8d3be386987248ceec91da3b5ae9721a7cc1fa4003489830
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WNCRY
        • Size 2KB
        • SHA256 4ba2b41e7226cd42808ead575aa1c1261368c93de810160ff44ddefe5d97408c
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WNCRY
        • Size 3KB
        • SHA256 9f9ea248189bcc7a2bef4dfc6de90a852f60adcbaebde7ddef36058be6401381
        • MD5 SHA1 SHA512 TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WNCRY
        • Size 4KB
        • SHA256 3f39a5f470364abdf1455b03b0e82d3c0e5e0bd25f05e046cb76ac048c354b66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WNCRY
        • Size 2KB
        • SHA256 bbe7290a236f44176739fbc54905850f3b1ca7d6776b98ca7d48dcd92a1579cc
        • MD5 SHA1 SHA512 TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WNCRY
        • Size 1KB
        • SHA256 e952552f2ead4c145ce12b71d12c6f4b279d357f821643f74bacdf503f14addb
        • MD5 SHA1 SHA512 TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WNCRY
        • Size 4KB
        • SHA256 00a7de19271e3082d83f300f51f8e20aba26122ccffe9d449d28de4b9ab95236
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 0b871353f1e44849d9c895d36aaa48dd3731a82f2074236a95e6aca5ee1132b6
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WNCRY
        • Size 1KB
        • SHA256 2eaa85d9f31b46aa686fedc2eb740ef529c24565769e33c5c7ec256985bcf886
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WNCRY
        • Size 1KB
        • SHA256 ee82ff2d1fcdba9cf93dd18d6aefbd072198625b4a6e7911d5b25f93c6b2e25f
        • MD5 SHA1 SHA512 TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WNCRY
        • Size 1KB
        • SHA256 59131162f5644d549ef6ae45164f10b6db1c6cd2dd5a805f23cf416b4d7b39cd
        • MD5 SHA1 SHA512 TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\128.png.WNCRY
        • Size 3KB
        • SHA256 60697fa3769943a668a0afdfc90d48e4ddcdfd8eb8606d09152352595c81fed4
        • MD5 SHA1 SHA512 TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\192.png.WNCRY
        • Size 2KB
        • SHA256 5c1d98c66acba49f8239d0c73e71d6f4e68d3309dd68dffde10c70f4983dd3c8
        • MD5 SHA1 SHA512 TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\256.png.WNCRY
        • Size 6KB
        • SHA256 32b66e8547c62cb4ca73629180dd033a44b1cd21d7b8ce5136183a94930f9f13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 3ce3476addf2fe21ae5f825b05d3bb932c80770bd81ca133076ac9fc9b93aa40
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png.WNCRY
        • Size 2KB
        • SHA256 f46528b3161f888011673c10336677f85c0126a07ba1cff451d43c9a1fdb087d
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png.WNCRY
        • Size 2KB
        • SHA256 07222794ab05751c69c42c760b5d3b5fd6f16759e66910c2736acbdcf7c0fbd0
        • MD5 SHA1 SHA512 TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\96.png.WNCRY
        • Size 2KB
        • SHA256 d4c9262747e43f34152a3137003d674ef543847d764b3d6b2443a68966e91f33
        • MD5 SHA1 SHA512 TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WNCRY
        • Size 2KB
        • SHA256 ad56bf4147a1f1dd79666e8a39647a2ab58a7a44062eb68fc37e50ec4b5467dd
        • MD5 SHA1 SHA512 TLSH

        192.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WNCRY
        • Size 1KB
        • SHA256 0fec928291aaa69f0e24594e0a9d6b87496c3e1ac4de7d75a808ded8ba201d0b
        • MD5 SHA1 SHA512 TLSH

        256.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WNCRY
        • Size 4KB
        • SHA256 05f8d608be30789c202f1b514d4f591877098dcc22707abe79009005db5a8028
        • MD5 SHA1 SHA512 SSDEEP TLSH

        32.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WNCRY
        • Size 1KB
        • SHA256 93a54d84236b0d612378cb6ef0958538bf975965934ea0d9ec146fac5ffcad3d
        • MD5 SHA1 SHA512 TLSH

        48.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WNCRY
        • Size 1KB
        • SHA256 a7e7a741cd57254c686e097b19dfe006e78958333e0144f2c4098cf3e4bc952d
        • MD5 SHA1 SHA512 TLSH

        64.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WNCRY
        • Size 1KB
        • SHA256 79a39bd10d90754962dcd5c6934955182501780f35d24a8c86f6c9ff955be226
        • MD5 SHA1 SHA512 TLSH

        96.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WNCRY
        • Size 1KB
        • SHA256 dbf06e682a31a4e91ab212228b81e5c17b3acaec704206876dc6d5368e7e5c8f
        • MD5 SHA1 SHA512 TLSH

        heavy_ad_intervention_opt_out.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY
        • Size 16KB
        • SHA256 5b3d0e98c70bb6d185a9285d4111922ab96b8b1a158ef475afca5fcd4ef96ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        first_party_sets.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRY
        • Size 48KB
        • SHA256 dc5f43ea31d2351a4d1436b897e5df1a02717931eb8f92ffcf20d969a37408bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IconCache.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\IconCache.db.WNCRY
        • Size 11KB
        • SHA256 f21e43646cd264b7d7399c340f1c274d08d8be4adb69739929270368d70b22d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EdgeEDropSQLite.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.WNCRY
        • Size 32KB
        • SHA256 e5ea683f042822ab6ab93af53bd05c2b77e74e398771d416ede85529f1907173
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EdgeHubAppUsageSQLite.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.WNCRY
        • Size 32KB
        • SHA256 1dbdbb342b0ee8be6d39aeab8fc1e05e329bfbc8e71ef95a84d74a249b100848
        • MD5 SHA1 SHA512 SSDEEP TLSH

        128.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\128.png.WNCRY
        • Size 5KB
        • SHA256 e6a2c2220c7b8d6b1ae7d0d78139f78a703a6eda938507f9478213ddf3d9b4ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        offscreendocument_main.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\offscreendocument_main.js.WNCRY
        • Size 130KB
        • SHA256 19405ac18fc3f1cc27d17e59666f05a8979a7f51b42354133ba72c49611367fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        page_embed_script.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\page_embed_script.js.WNCRY
        • Size 632B
        • SHA256 1711241d5529acdfabe69c3cd094b927c6c2bd66951422d7b652607112fe73da
        • MD5 SHA1 SHA512 TLSH

        service_worker_bin_prod.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.110.1_0\service_worker_bin_prod.js.WNCRY
        • Size 136KB
        • SHA256 051cd03df9e387d8bb002bf81ba51d0e5669e8cb2b4b5784d781055d78dad34c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        content.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js.WNCRY
        • Size 9KB
        • SHA256 aa338af8f1faba4aa7d6f2fed9c4478252bc1b079cb0899b5be1d4069c934eed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        content_new.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content_new.js.WNCRY
        • Size 10KB
        • SHA256 cd994018c1ad6a9364253a8ffaea7f048073bb9d57011d804e28dd1a441ece33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        index.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.WNCRY
        • Size 664B
        • SHA256 e5dc7e3518f50dc83e70ba060e82540fe5e661d91e4914b79249c93665a44b34
        • MD5 SHA1 SHA512 TLSH

        heavy_ad_intervention_opt_out.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRY
        • Size 16KB
        • SHA256 83a42374606effaa10f6efdddca64906d74f7518f482061638f6174438a92ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        load_statistics.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRY
        • Size 4KB
        • SHA256 0abb0161abd12ef860664d263f05a9e33f122f7bdec75eaf7171f18b8993b957
        • MD5 SHA1 SHA512 SSDEEP TLSH

        data.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.24\data.txt.WNCRY
        • Size 152KB
        • SHA256 4ee93fbad969dcabace66a61f86d481ca5018bf0252ae86ee10bc55452726cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        arbitration_metadata.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.WNCRY
        • Size 343KB
        • SHA256 692636f0b5f61024f4a1f0ff42555fb55193910e32af53c5e4aab1be3ee2e1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        automation.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\automation.js.WNCRY
        • Size 4KB
        • SHA256 f4afee36e08a360b5f0f1f8db078b8eb9fed27bea340d4bf05654ff4f25f48e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        classification.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\classification.js.WNCRY
        • Size 1KB
        • SHA256 72d3fbc161c42af2f4fc086a0664e7960e3ec8989af7a7a3c11eb8ba6de183b6
        • MD5 SHA1 SHA512 TLSH

        extraction.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\extraction.js.WNCRY
        • Size 5KB
        • SHA256 73f327e06a71f5ea3cc0faf8d7b498fb40ad37a9aa3de9b6166af1b090881316
        • MD5 SHA1 SHA512 SSDEEP TLSH

        travel-facilitated-booking-bing.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-bing.js.WNCRY
        • Size 2KB
        • SHA256 bae5bdec3f6ef4f4d62a8ac360416758fe24a147b78bea2ac17d27bfa3e28a6d
        • MD5 SHA1 SHA512 TLSH

        travel-facilitated-booking-kayak.js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Travel\1.0.0.2\travel-facilitated-booking-kayak.js.WNCRY
        • Size 5KB
        • SHA256 84cac2f0012750de049db3183126676f4c0875903e768d68b782fa4d87fa9fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        first_party_sets.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\first_party_sets.db.WNCRY
        • Size 68KB
        • SHA256 b193290255acb978bece024cdbcfe68ed274019324972cb9ac71642405f412b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        brndlog.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRY
        • Size 6KB
        • SHA256 802ff0e19cf784960045ca1162a81f3e97689599b79a60ba063fa9ae52c5e9c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mip.policies.sqlite3.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\mip.policies.sqlite3.WNCRY
        • Size 36KB
        • SHA256 cd4cf9516702a71dea85b13736e4c96bf8df626720b35370967367d19789f281
        • MD5 SHA1 SHA512 SSDEEP TLSH

        excel.exe.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRY
        • Size 24KB
        • SHA256 24957ed6383732d683149ede2b58dcc1087bf771ad14edd65c34514af7340e13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        officeclicktorun.exe.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRY
        • Size 24KB
        • SHA256 5aad668a2c5d103b65b313de7114c9bb43c4ac2375b2fca718bcefa839d5a120
        • MD5 SHA1 SHA512 SSDEEP TLSH

        onenote.exe.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db.WNCRY
        • Size 4KB
        • SHA256 3bc5e4f949e9e9bec933cb83a37a19b074bf9e8c1831dda1bd54dbc631fb0b17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        outlook.exe.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\outlook.exe.db.WNCRY
        • Size 4KB
        • SHA256 bec3cf1b9f273cc35f7496fff3ff2ab9a33bb8e8e8bf4cbfdd7653356af4d8ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        winword.exe.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WNCRY
        • Size 24KB
        • SHA256 008c417a0b571fa37210fe148408547847e552803cb2e6e69b1c1e111e0edee8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppBlue.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppBlue.png.WNCRY
        • Size 5KB
        • SHA256 d92ffd0903d5465ce76da206f9e190aee65c12cabdc7abaef719f5e0b88f5a64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppErrorBlue.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorBlue.png.WNCRY
        • Size 7KB
        • SHA256 11526063fbb5e05b759a3c4e01c8d3b590127e12a4d686c476d90534827c6b81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppErrorWhite.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppErrorWhite.png.WNCRY
        • Size 8KB
        • SHA256 3cc7a5284af4bd633ad06185e2517a45f81c4907aaa563e152704d0c4f4b8f53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppWhite.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AppWhite.png.WNCRY
        • Size 3KB
        • SHA256 53bddc3433d0c503b335e10c950fa15cf7a9d93526c6e112dfcfa74f62e311ab
        • MD5 SHA1 SHA512 TLSH

        AutoPlayOptIn.gif.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.gif.WNCRY
        • Size 374KB
        • SHA256 883f0ea5e2e97ba1fb92a12fe121420c317c9096a1bcb60b7016ad420843ca7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoPlayOptIn.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\AutoPlayOptIn.png.WNCRY
        • Size 10KB
        • SHA256 58d91c585dac3e7d6402ebeb65ace2693dede9aad4ee464a1fe1e1c38ea100dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CollectSyncLogs.bat.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\CollectSyncLogs.bat.WNCRY
        • Size 6KB
        • SHA256 3806862e330a43e2bb642d5c518f73645bbb486c0dca859dabe153881c91b64e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ElevatedAppBlue.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppBlue.png.WNCRY
        • Size 7KB
        • SHA256 db9f5415cc4db50b11c341aab7c3819a5b9968fd756635023f5d40831fea42a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ElevatedAppWhite.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ElevatedAppWhite.png.WNCRY
        • Size 5KB
        • SHA256 37fc3a8f8a4f39c61461c8c792c174a4e3dd81c05a30b2bf361b6829ab7518a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Error.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Error.png.WNCRY
        • Size 7KB
        • SHA256 fba62f7d18d448e1656e877dcb05ea2424a7a06f8d024a029e5976ee3860941b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KFMHeroToast.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMHeroToast.png.WNCRY
        • Size 15KB
        • SHA256 4972a19febd5dc47cf69b63c81486179154345fa2e1767f9b928b41ea7c39682
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KFMLockedFileToast.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMLockedFileToast.png.WNCRY
        • Size 10KB
        • SHA256 9a63536908f7b8eaf95451460a520f9c2b21a9f76175fdd0944e67c9983eb6a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KFMScanExclusionToast.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\KFMScanExclusionToast.png.WNCRY
        • Size 10KB
        • SHA256 989f7c948b444e403f63f96d4b4df62f1afdedeb80df3473dd22203290252266
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OneDriveLogo.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\OneDriveLogo.png.WNCRY
        • Size 4KB
        • SHA256 65d0559b7ade3d6de3baa3f88a1c0bcf6ef90cd59b5d5b546a401ac9d78d350e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuotaCritical.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaCritical.png.WNCRY
        • Size 8KB
        • SHA256 cf5debabe5ae18003663ea8b372cccb573ac15e50bf9dc236875c27e09e845f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuotaError.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaError.png.WNCRY
        • Size 9KB
        • SHA256 2f388031f156a2a3a1f633d4254751ddeba360509714084102be95b8ffcc3a83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        QuotaNearing.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\QuotaNearing.png.WNCRY
        • Size 7KB
        • SHA256 de9a94c19614c562f451bb69b438d73be55894cf4522466723ea1fc02a3ddaca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ScreenshotOptIn.gif.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ScreenshotOptIn.gif.WNCRY
        • Size 238KB
        • SHA256 86c75bfed49955d4729731d257a711dfc1202b14ffbc80a320c4783fb00162e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ThirdPartyNotices.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ThirdPartyNotices.txt.WNCRY
        • Size 48KB
        • SHA256 18d48e517f5fb45947959fd253700da787eab6a3554dc0d6451be73e32f3e30a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Warning.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Warning.png.WNCRY
        • Size 2KB
        • SHA256 7fc779281fa2f3cb73d1704baed5bafae75be76e4beb069829f543310ab8e8c7
        • MD5 SHA1 SHA512 TLSH

        alertIcon.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\alertIcon.png.WNCRY
        • Size 1000B
        • SHA256 3a8c276dfcc5fdc1826893fc79dd5d9bafd2a06a0b6a40f669b604b5ba71d352
        • MD5 SHA1 SHA512 TLSH

        acmDismissIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\acmDismissIcon.svg.WNCRY
        • Size 2KB
        • SHA256 64e5ac229cc3ac453ed2547f0c7ac6612c5f7e2bccaf255c7d3586cf497352c5
        • MD5 SHA1 SHA512 TLSH

        blurrect.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\blurrect.png.WNCRY
        • Size 1KB
        • SHA256 615aeb0ec515a71195293ffe57fe54ff96c91ac9a27863dd958ca25e048b1ac9
        • MD5 SHA1 SHA512 TLSH

        checkmark_finished.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_finished.svg.WNCRY
        • Size 504B
        • SHA256 3aaebdc2fab29e8a8aa4cef8b728da32f1d396d111830493792fa0ced6f68880
        • MD5 SHA1 SHA512 TLSH

        checkmark_hovered.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_hovered.svg.WNCRY
        • Size 680B
        • SHA256 4118889a17b144615ed09f754fd9614f5ec5b717cad5c2b77b175d0fa52e8db3
        • MD5 SHA1 SHA512 TLSH

        checkmark_in_progress.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_in_progress.svg.WNCRY
        • Size 680B
        • SHA256 a490f06f5e0bd07b329c16357202c8d5c62b673fab86fcfccbe2d011c742c878
        • MD5 SHA1 SHA512 TLSH

        checkmark_selected.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\checkmark_selected.svg.WNCRY
        • Size 680B
        • SHA256 fa4ce3fd4d8d961b4e6c8c2eac9ebc12558a985c6944a02a443fe2cb2d83d751
        • MD5 SHA1 SHA512 TLSH

        chevron.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevron.svg.WNCRY
        • Size 584B
        • SHA256 a8ced3ff18136a899258207c202690f6ec249c3ec01ee09ef92f30e17242afbd
        • MD5 SHA1 SHA512 TLSH

        chevronUp.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\chevronUp.svg.WNCRY
        • Size 552B
        • SHA256 919d837ab7367e67ba49726c65b0ac207c2be8691bd7211c6b4e28fe051fce36
        • MD5 SHA1 SHA512 TLSH

        cloud.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\cloud.svg.WNCRY
        • Size 1KB
        • SHA256 1bd4bdc7661bb3dd158b1eadd3c96e01d7443c99e84bd85787370b0248429a81
        • MD5 SHA1 SHA512 TLSH

        done_graphic.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\done_graphic.svg.WNCRY
        • Size 15KB
        • SHA256 110832cc973d17bb638d5a90ae840cb01c8220be3ca99b5ca8bfacb2d9b59d3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        errorIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\errorIcon.svg.WNCRY
        • Size 1KB
        • SHA256 09bc2c349d8e6602236bcf6960ac8a1055e97216b72ab2917de77b31828d8d65
        • MD5 SHA1 SHA512 TLSH

        folderIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folderIcon.svg.WNCRY
        • Size 1KB
        • SHA256 be14e93f46a6883416a0b247a4b68e0c2b718c8d999712d3037d3f6457cb9d1a
        • MD5 SHA1 SHA512 TLSH

        folder_image_desktop.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_desktop.svg.WNCRY
        • Size 2KB
        • SHA256 0b31368d0e59298d467101d1b7418393e8030dd89392cb3cf42829724935f237
        • MD5 SHA1 SHA512 TLSH

        folder_image_documents.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_documents.svg.WNCRY
        • Size 10KB
        • SHA256 d9b324caeb8e6d2f2a7d3a18bd94f197234f3bd2d37ab7427a64348b2ca83a6f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        folder_image_pictures.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\folder_image_pictures.svg.WNCRY
        • Size 7KB
        • SHA256 a14e1dc2ed5ae58d709882552894dfcbb8abbea942600bbe5736febdd614958f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        globeIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\globeIcon.svg.WNCRY
        • Size 2KB
        • SHA256 407e028863e394b85a683f07d7019ece8b80615c7243525c310d0e67b90db3a8
        • MD5 SHA1 SHA512 TLSH

        iceBucket.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\iceBucket.svg.WNCRY
        • Size 6KB
        • SHA256 a52c91c9363ab93bbf567794a9cdd863bc171423d23fd83c4863959f42462e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        infoIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\infoIcon.svg.WNCRY
        • Size 1KB
        • SHA256 1b808444c6e3b0f3a67be009c7641ff0dec8d7898c42292ed87d16d0e29f1cba
        • MD5 SHA1 SHA512 TLSH

        kfm_folders_image.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\kfm_folders_image.svg.WNCRY
        • Size 20KB
        • SHA256 0a6c28f590d4d0f0cbcfbe94efcd0be0499c5484942c1d6d7d3c69d8bc1e1168
        • MD5 SHA1 SHA512 SSDEEP TLSH

        loading.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading.svg.WNCRY
        • Size 1000B
        • SHA256 699769811186f31af1d0123547fb940d90f7d9cf8b74bec9ab56300a8e974451
        • MD5 SHA1 SHA512 TLSH

        loading_spinner.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading_spinner.svg.WNCRY
        • Size 712B
        • SHA256 94c52682c0615fe1bccfcf2bc28903a90ce2fae59067a4dcca82aa2f25c803f5
        • MD5 SHA1 SHA512 TLSH

        onDemandFiles.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFiles.svg.WNCRY
        • Size 7KB
        • SHA256 f52bf8480f788b164fcade00c0089ef05a050dcdd7e47f220162a2a371e5685b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        onDemandFilesDehydrate.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandFilesDehydrate.svg.WNCRY
        • Size 9KB
        • SHA256 cfe1f9ee691db601155d27500a16f6b1ef37435a8807cde9ddcf18261981cf2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        onDemandSelectiveSync.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\onDemandSelectiveSync.svg.WNCRY
        • Size 2KB
        • SHA256 07e8cda0c39c0eff048018fa33739e13e6332863cdf30cf9d0f4a4a5c246afa1
        • MD5 SHA1 SHA512 TLSH

        overflowIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIcon.svg.WNCRY
        • Size 1KB
        • SHA256 01117d9b951f1d2cb35117351e34798c69fc5885e6eecb010979a85390684488
        • MD5 SHA1 SHA512 TLSH

        overflowIconLarge.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\overflowIconLarge.svg.WNCRY
        • Size 1KB
        • SHA256 310a5398596b9d1ac28f77fdd791204719fd680c746d1ab37ff3b2464a0a377c
        • MD5 SHA1 SHA512 TLSH

        partiallyFreezing.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\partiallyFreezing.svg.WNCRY
        • Size 4KB
        • SHA256 7ee0f5ee7638725b236928a671da8f3d07aba9a8ac2d103de87b446d697ecce8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        paused.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\paused.svg.WNCRY
        • Size 600B
        • SHA256 2e0458bcfe30f9f0fbb1b675251fae9cd6ab4d9521c45118de261f6f8609c23b
        • MD5 SHA1 SHA512 TLSH

        premiumIcon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\premiumIcon.svg.WNCRY
        • Size 664B
        • SHA256 8abc793adf21f3d49732726c7e8f9acaf82f52dc54a5371dd898208d2fd38ee2
        • MD5 SHA1 SHA512 TLSH

        recycleBin.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\recycleBin.svg.WNCRY
        • Size 3KB
        • SHA256 2206f908b2e545aa4aa9e7402abfdc2cee288f49eecc67a4c7aa4551ea7ff62f
        • MD5 SHA1 SHA512 TLSH

        shield_icon.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\shield_icon.svg.WNCRY
        • Size 1KB
        • SHA256 0f7f7286d63cf312476014b29a7585ca5622ec0821dbe3518e8b84956233879b
        • MD5 SHA1 SHA512 TLSH

        signIn.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\signIn.svg.WNCRY
        • Size 10KB
        • SHA256 9a59e2632892dc399b2986e421a0da8ae0fe68f3b446e619c3dd91772fd28b60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        stackedIceCubes.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\stackedIceCubes.svg.WNCRY
        • Size 4KB
        • SHA256 9125309c37302df0eeac0d19149e3c97eef3c582fc897b76b3aef920af7d2513
        • MD5 SHA1 SHA512 SSDEEP TLSH

        warning-symbol_grey.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\warning-symbol_grey.svg.WNCRY
        • Size 536B
        • SHA256 9762b548dc3c394034338004d6d1a09893a34d849b22153fa1c3d70401e283c1
        • MD5 SHA1 SHA512 TLSH

        waterGlass.svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\waterGlass.svg.WNCRY
        • Size 2KB
        • SHA256 1c021a68d9a1054ada7b432c19047aaab49a09216107275a20b0ed147d56adb8
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-black_scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-100.png.WNCRY
        • Size 936B
        • SHA256 e130040edb297e428887c1c95692994c18a43d798a7230aa415cb2d5bc50fbf7
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-black_scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-125.png.WNCRY
        • Size 1KB
        • SHA256 8ad68fb206c1ec196fc1b7e314697f19c7073319188e581c19b2cdf73b2604bd
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-black_scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-150.png.WNCRY
        • Size 1KB
        • SHA256 44a80f34ca45809063bc6b75545e317ef2a0652754e2d4e9adbd9152b2829c52
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-black_scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-200.png.WNCRY
        • Size 1KB
        • SHA256 3402428988449d8552895cb6b29bed659e01f4f711e2f690f57631f484db0a44
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-black_scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-black_scale-400.png.WNCRY
        • Size 3KB
        • SHA256 5e7e05779f449bfc2b7e46d73caeea3e1ca4e88aa3b1b232d980d27c271af038
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-white_scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-100.png.WNCRY
        • Size 952B
        • SHA256 d4824a751cb65b7f216418c44d9fc9915bd1fcf5c323191e91c67afd6be091aa
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-white_scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-125.png.WNCRY
        • Size 1KB
        • SHA256 51f854eeb49800eefe573e437dad0493ce1d7c681e059c4bf1b3cb469ffe6b1a
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-white_scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-150.png.WNCRY
        • Size 1KB
        • SHA256 3866ea7c765bfe9c0cbea18d6275bee5bb17f0e2377d8aeb958551add1a217c4
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-white_scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-200.png.WNCRY
        • Size 1KB
        • SHA256 559557511fbcedb7e0ff95de1d14fa62c2fd7415f5bd0c0bc7f6c52a8172bf44
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.contrast-white_scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.contrast-white_scale-400.png.WNCRY
        • Size 3KB
        • SHA256 ab2ce3b9f222cb6d279eb678d2b740c5c8e4e2fa4c91fcebe755eeb871c1c766
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-100.png.WNCRY
        • Size 936B
        • SHA256 d396ba6e6268365a1f1c7140c6eaeac23d8560b910041a82f78c79ee20e2a83e
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-125.png.WNCRY
        • Size 1KB
        • SHA256 0fbd53dc21e9ef3837fe6afae0cf008dacb8d09eb1c55cc0d10d78de22d989a0
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-150.png.WNCRY
        • Size 1KB
        • SHA256 6526d8cb277898f9b173e8bd8e7ad820f6f07bcf45730444810705ef9f90fadd
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-200.png.WNCRY
        • Size 1KB
        • SHA256 87347c12f5b210a678264053695cd67b02ad9cf8f061d88ace68a34f9b957b06
        • MD5 SHA1 SHA512 TLSH

        OneDriveMedTile.scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveMedTile.scale-400.png.WNCRY
        • Size 3KB
        • SHA256 9c13335b769c425978330660cc0cd9ae9feaf2d80dc0e1a91f980905b56b2e74
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-black_scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png.WNCRY
        • Size 696B
        • SHA256 4affd80025fa2ceff7d6baa6f95984449fdf2b364be0f043a22d42ab3219b270
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-black_scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png.WNCRY
        • Size 808B
        • SHA256 e4914c34dc23c1f870ffe9f7488c162bf97bd4002ce089b06ce1d8e4de174777
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-black_scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png.WNCRY
        • Size 872B
        • SHA256 d824a63c9e6478c00f27e34ff1650f2e7017de916234ce88c3cb98996bf13b8d
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-black_scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png.WNCRY
        • Size 1KB
        • SHA256 86ecbb48d5c42947f5b612bbae924d1d65da8b08b35deca3924aaedea79b5756
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-black_scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png.WNCRY
        • Size 1KB
        • SHA256 fefdcec5571d62c0929fd2aeadf93ad0cf2686f432bf98278f90b545dd1a8d61
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-white_scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-100.png.WNCRY
        • Size 696B
        • SHA256 ad5ff6007c1173650911213087384def92d835bf74af238d7cb0a1b8425cfbea
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-white_scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-125.png.WNCRY
        • Size 824B
        • SHA256 1038f4bc90e35e120d8f3d187f58d58fd66866083b7870739f953c4c3a405ccf
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-white_scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-150.png.WNCRY
        • Size 888B
        • SHA256 3a67c82c3958a0c00c7c56b3b146de340889c0ce7288cef32c6aa3bb10e5a0b8
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-white_scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-200.png.WNCRY
        • Size 1KB
        • SHA256 f6d9ec498b3221fd567107184da0910d200f4d28d709192c649a1f61ad975cf6
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.contrast-white_scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.contrast-white_scale-400.png.WNCRY
        • Size 2KB
        • SHA256 ad47b7bebbc4a2ce5a39e88bf895bfedb4c579ed7b004dd4989aff18fc6d0ebb
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.scale-100.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-100.png.WNCRY
        • Size 696B
        • SHA256 0fe0ccc0686faf7f92dd899f94fc2d40ea1df27a6f5dcb167bef3685c2b79438
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.scale-125.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-125.png.WNCRY
        • Size 808B
        • SHA256 b15560f1d924dd952bbe665072186bd16465cccfc511b755afa6a1f91a6b90a4
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.scale-150.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-150.png.WNCRY
        • Size 872B
        • SHA256 3032c46e2ecd2f72047524738155b20b3e83bbd52938c2081413fa705c41f1ba
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.scale-200.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-200.png.WNCRY
        • Size 1KB
        • SHA256 f12d8fcd5493a02a86e7ebcb9e899770e51a6b9dcaeea9e14a569677c6f1825e
        • MD5 SHA1 SHA512 TLSH

        OneDriveSmallTile.scale-400.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\LogoImages\OneDriveSmallTile.scale-400.png.WNCRY
        • Size 1KB
        • SHA256 f199971ae03d83ba2575fbe08bc01bc65f5c6428a9e8db46b92794c9c42d2f28
        • MD5 SHA1 SHA512 TLSH

        cversions.1.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRY
        • Size 16KB
        • SHA256 40fc795bd47e8995350bfc5dd41b193af303989ad3cbcf6e39cd8bd507e906e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cversions.3.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRY
        • Size 16KB
        • SHA256 bd430630009a30f11bb1c67442017c1c14cdfd015e3fdc13ca1b0b4b73daf3c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{03BA58C4-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRY
        • Size 414KB
        • SHA256 29689297e5349532c22553ec242d4d224090d7c5679684df9e1d4b192e9a4991
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000020.db.WNCRY
        • Size 93KB
        • SHA256 6095c458347f04d61aaf0a5ff97ffcbd3d02c2ad750a75af3878dced9bd8dc64
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db.WNCRY
        • Size 83KB
        • SHA256 c12ae6708ae77d92199b659bfbfcd149cae654f1693afdc70df647c1abe2e5c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        {AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000013.db.WNCRY
        • Size 85KB
        • SHA256 619a8fd9cba3a53eedce08a457afb15fdb629b801cbc02b5a2e01ec5fe983b26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_1280.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WNCRY
        • Size 312B
        • SHA256 13b44642a59d75528a0f671d4d9aa3faf246337d2e8b8c5969addadf85ab0942
        • MD5 SHA1 SHA512 TLSH

        iconcache_16.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRY
        • Size 1.0MB
        • SHA256 225d5936ec66109e5eda8439777caf0d00fb08d754e975934bfe3a5f27334f55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_1920.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WNCRY
        • Size 312B
        • SHA256 1fbf2bd7fdfcd9fb7415b0c55c87284cd5a0b67b05face454c89d51d981ca296
        • MD5 SHA1 SHA512 TLSH

        iconcache_256.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRY
        • Size 3.0MB
        • SHA256 4942aaaac29495d2347db7ae0fca568a813c8f0d48e0ddb6af93cf437abd12cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_2560.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WNCRY
        • Size 312B
        • SHA256 99c67e1593e45cb4d3164204698ea60e2733deddf2ec9d85a4430073069846b7
        • MD5 SHA1 SHA512 TLSH

        iconcache_32.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRY
        • Size 1.0MB
        • SHA256 157bae0a2095253acd49a8468d81fa0f4fd8d6ce9a3d04daab0762d65577f45a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_48.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRY
        • Size 1.0MB
        • SHA256 8997c6d14dbb4f3c79c4f47250b3c505d4ca1f36591e8ddfb9ef7ce04e641a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_768.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WNCRY
        • Size 312B
        • SHA256 c37cebe471072cf5bf2b66c46ca086f74dfcfaf274eb17b4ab95cb206d1b1bef
        • MD5 SHA1 SHA512 TLSH

        iconcache_96.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WNCRY
        • Size 312B
        • SHA256 5c54715a80a5aa2fa24ff52d109de0f4bb03ba96c44261f34b2b147628a58a3b
        • MD5 SHA1 SHA512 TLSH

        iconcache_custom_stream.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WNCRY
        • Size 312B
        • SHA256 a93ce12061e6b759eba7ac62438b27b27954c6bbec71008901163c0b8a4ed518
        • MD5 SHA1 SHA512 TLSH

        iconcache_exif.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WNCRY
        • Size 312B
        • SHA256 7b3fa860c5b41a43bd26f986e813135633235161baecd61b2bcd2fd6b5772251
        • MD5 SHA1 SHA512 TLSH

        iconcache_idx.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRY
        • Size 28KB
        • SHA256 513057145c49568fb77c04269820fb22b8742463416b6c5f609cdf45f8623a50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iconcache_sr.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WNCRY
        • Size 312B
        • SHA256 ba1ad245e22209c721205dac304d29187fc75104d5d37218a697de3a8b840baa
        • MD5 SHA1 SHA512 TLSH

        iconcache_wide.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WNCRY
        • Size 312B
        • SHA256 3c8f42e3ca28c8b72590ce63c22ddb490435a16da4fc00da839a29e13d23a6c5
        • MD5 SHA1 SHA512 TLSH

        iconcache_wide_alternate.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WNCRY
        • Size 312B
        • SHA256 dc44e6313ebada155d77954253454142bea373543a7ad2b05364b06c58e25b61
        • MD5 SHA1 SHA512 TLSH

        thumbcache_1280.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WNCRY
        • Size 312B
        • SHA256 d5ed4de03ab776d0498c32f05d77f0622d54502219d7e0d1121923a2b3633160
        • MD5 SHA1 SHA512 TLSH

        thumbcache_16.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRY
        • Size 1.0MB
        • SHA256 0c11d565fa7a44dfc3c67e1e8af207391aec6cdeec1010f28d3ff1d051ccad0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thumbcache_1920.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WNCRY
        • Size 312B
        • SHA256 b50eb46f530851efaea2ce2e3976b92e34f8e5f9e4c80e070e9c0b7d7d32464e
        • MD5 SHA1 SHA512 TLSH

        thumbcache_256.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRY
        • Size 1.0MB
        • SHA256 6a5499925740f33d5e7c8e781e8b6c6bedec3efedf89a3b72d582a0ae7d22f79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thumbcache_2560.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WNCRY
        • Size 312B
        • SHA256 de62d98b812c598cbb4c866e8c3f922304a378e4bb9cba5a43fd217c04c225c0
        • MD5 SHA1 SHA512 TLSH

        thumbcache_32.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRY
        • Size 1.0MB
        • SHA256 f80adf9b5fa064abd8df42ee7d71c59a93eb38cc9bd8faa95c41fe733c6debcf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thumbcache_48.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRY
        • Size 312B
        • SHA256 3176e88f05cb75d00a2b053bc1d045991ead8fff42ece51a15155d7640c79543
        • MD5 SHA1 SHA512 TLSH

        thumbcache_768.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WNCRY
        • Size 312B
        • SHA256 019a9220e7f85ae1145d003e64258261c83dcab0773d2f892e8a777500de6699
        • MD5 SHA1 SHA512 TLSH

        thumbcache_96.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRY
        • Size 4.0MB
        • SHA256 b5d98c00063dc16073d1b959a50ff0ce4d3db95ea2921ef7a9bb078636f4868c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thumbcache_custom_stream.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WNCRY
        • Size 312B
        • SHA256 0535e1a6be7de4f4c2ec9fc2a289c71956750830f6589d9138bc006e97c96f20
        • MD5 SHA1 SHA512 TLSH

        thumbcache_exif.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WNCRY
        • Size 312B
        • SHA256 90e4bc536b69c8ebab36cff7973e097aea5aa9dce2b9a0ea1b227fcce12930c1
        • MD5 SHA1 SHA512 TLSH

        thumbcache_idx.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRY
        • Size 28KB
        • SHA256 e90afe0ccf30fef8bf171cfc98c2fc3f144bcf3bae8fd6feb4942e7ee9aae5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        thumbcache_sr.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRY
        • Size 312B
        • SHA256 eb82d41d49d4f293b9c5a7e2a481dd7009cf8c41d49c759156aec86cdb8a3651
        • MD5 SHA1 SHA512 TLSH

        thumbcache_wide.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WNCRY
        • Size 312B
        • SHA256 08c73b30128d8690178deba10f8e6239ec3e13b3fcc0b0b0a251db307e93397f
        • MD5 SHA1 SHA512 TLSH

        thumbcache_wide_alternate.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WNCRY
        • Size 312B
        • SHA256 795a362b0d22b4f26d5cf8aee9e152ecd742004a44add797facd6a850dc0e655
        • MD5 SHA1 SHA512 TLSH

        AAehyQC[1].svg.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\AAehyQC[1].svg.WNCRY
        • Size 3KB
        • SHA256 12cdcc4954f4efd967bae7b0a2d9032f1a8729c5a79931e87384162801901ed9
        • MD5 SHA1 SHA512 TLSH

        {8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPBSYQOV\{8a69d345-d564-463c-aff1-a69d9e530f96}[1].bmp.WNCRY
        • Size 6KB
        • SHA256 8de584d4a7faf8e8caab91f5ba7f42433ee66421fb40641f87dda0453e7dd1d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fabric-chunk_vendors_E7vUDAv61iVCiyoz3ABkzQ2[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UN11FRGI\fabric-chunk_vendors_E7vUDAv61iVCiyoz3ABkzQ2[1].js.WNCRY
        • Size 551KB
        • SHA256 319cf7d4d796cc90c8947505c352cf292fae832ba3d97636a988f5073b3e393d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        legacy-polyfill_N8Ga2ha8NZXKE88suhqTHA2[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UN11FRGI\legacy-polyfill_N8Ga2ha8NZXKE88suhqTHA2[1].js.WNCRY
        • Size 135KB
        • SHA256 083734694834025353d4afcb78b71d129d5d3982281c39ee61179fa61c6a8ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wpndatabase.db.WNCRY

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRY
        • Size 1.0MB
        • SHA256 1ff1cba05e2de528c38a660da78305fe1521dc9c109287d354b2ca144a576955
        • MD5 SHA1 SHA512 SSDEEP TLSH

        squaretile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRY
        • Size 2KB
        • SHA256 591c218201388843808a3b87cb50993d5f79705e33636a7c05c1dc781874a623
        • MD5 SHA1 SHA512 TLSH

        tinytile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRY
        • Size 1KB
        • SHA256 a9d20cae5e3a0595c4e86e21c1ffb482d6eb8c17046789a96e2007bcfa4f36e0
        • MD5 SHA1 SHA512 TLSH

        squaretile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRY
        • Size 2KB
        • SHA256 9e4b87d6ca8c5d61352cbecf019755790afeb2ac3f5e7b991b714e0467cb89c5
        • MD5 SHA1 SHA512 TLSH

        tinytile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRY
        • Size 1KB
        • SHA256 61a85ee8fc7d878e34c7326f9dba99cac04ccf35017e741ce2e490db2b1a04f3
        • MD5 SHA1 SHA512 TLSH

        squaretile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRY
        • Size 1KB
        • SHA256 2da4a53269a7ab66203c6480bbf8d75a54935e7c7b14942507928514a3f2f281
        • MD5 SHA1 SHA512 TLSH

        tinytile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRY
        • Size 1KB
        • SHA256 8bbb881caa17efdd619b6a358409f57f865de89a7ee5170ef3c6459cd98842ab
        • MD5 SHA1 SHA512 TLSH

        squaretile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRY
        • Size 1KB
        • SHA256 60695fd3c779dce82547817782d3ecdb02f7c15a9ce7fbe0108c58ee1154eb05
        • MD5 SHA1 SHA512 TLSH

        tinytile.png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRY
        • Size 1KB
        • SHA256 7add6037e4bf8265713e30e14c789a20ae8ddd540ae6a6c5008bb405913ed96a
        • MD5 SHA1 SHA512 TLSH

        odc_homepagebigarrow_ltr-060c245a73[1].png.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\DO1LI5YV\odc_homepagebigarrow_ltr-060c245a73[1].png.WNCRY
        • Size 5KB
        • SHA256 89f04a67ab5864bb1ceb68c37b8a53cf70bd917b31e88cd736d94a0b9640b50a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\53dEtUrhAV5kBHY-GXbgbWghcig.br[1].js.WNCRY
        • Size 2KB
        • SHA256 fd633c83c40fda9396b3a0d1e74f7daeb4c9e669bac9b9584be5e373c6f167ce
        • MD5 SHA1 SHA512 TLSH

        5_Qy3kN7CMDIuIz_gxIKYIiSlE0.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\5_Qy3kN7CMDIuIz_gxIKYIiSlE0.br[1].js.WNCRY
        • Size 63KB
        • SHA256 957419639611bd34c1c94845a719d3b4d0159f07f4dfe7114319a358d9491332
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6Y5Lpywr0GtWwZp2QTDQ9BU5hkM.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\6Y5Lpywr0GtWwZp2QTDQ9BU5hkM.br[1].js.WNCRY
        • Size 87KB
        • SHA256 e249a2901ced81959bed4b2f609d1d4d339b68f8083d429ab8c7d38184f95204
        • MD5 SHA1 SHA512 SSDEEP TLSH

        75Izh7HFgy6cSu9rdaZkYjp-stc.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\75Izh7HFgy6cSu9rdaZkYjp-stc.br[1].js.WNCRY
        • Size 9KB
        • SHA256 7aa61fe57ebd17d7c0303eb81a0f0b118fa51b05bf1b10f49905cad20c2e5951
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BssPvDdoj1C9GPJrc4ePK4br97g.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\BssPvDdoj1C9GPJrc4ePK4br97g.br[1].js.WNCRY
        • Size 96KB
        • SHA256 b1d36014c86e6be0d88d7e6425c1bc918291f2ce40d11e27027727865939b379
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IBajuVOUJVU3NlyWM2Txlietv6o.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\IBajuVOUJVU3NlyWM2Txlietv6o.br[1].js.WNCRY
        • Size 349KB
        • SHA256 3b67680eb67f03141d91286eb7c649d3610db5bdbbdf77ace5dccfc4ce1e7ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        KiGbwlvCr6mDT2PTMkGTGMX8P-w.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\KiGbwlvCr6mDT2PTMkGTGMX8P-w.br[1].js.WNCRY
        • Size 42KB
        • SHA256 93955ed97dda1d129388d813c796979e758669a9fdf4bcc682fae7acd79519a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MxeJyjNgl4Wpe6lwn5kHkr4_-94[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\MxeJyjNgl4Wpe6lwn5kHkr4_-94[1].js.WNCRY
        • Size 1KB
        • SHA256 95fb567682d132c80300e4b265dd1dffcccd9f0a3010f13abef6c7e34445a173
        • MD5 SHA1 SHA512 TLSH

        RGMlHpHvBtpIoimRoi_VK90-Hv0.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\RGMlHpHvBtpIoimRoi_VK90-Hv0.br[1].js.WNCRY
        • Size 469KB
        • SHA256 1e1cfce53b3ce2913b9dd336b069dbad8e1985333e652564ba1b439f9df26b01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        S2z4mgWinRePGA60pm9jypzjvgk.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\S2z4mgWinRePGA60pm9jypzjvgk.br[1].js.WNCRY
        • Size 163KB
        • SHA256 f221462fc2683473480404ef230c68f91ed048b03ee4b5f46bee05894a944071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        XDGzKmz1XMmydyUdsLjQWSxd8yE.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\XDGzKmz1XMmydyUdsLjQWSxd8yE.br[1].js.WNCRY
        • Size 42KB
        • SHA256 140a93330b208da05fc36f5b735a1814239213c0bea17424775a2974ca27489e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _BnB-s6taBN8V2dSpgLpRUHcruc.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\_BnB-s6taBN8V2dSpgLpRUHcruc.br[1].js.WNCRY
        • Size 64KB
        • SHA256 f03be2241ff186759a978ee06ee6cbe7760d9d1233034aac6badecb976e8a8e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        iNPskXPmYT28qkQXzLg4o1yEVKs.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\iNPskXPmYT28qkQXzLg4o1yEVKs.br[1].js.WNCRY
        • Size 543KB
        • SHA256 54185460c44e5358160108b5160d5eb3a0a7ee97eb399553757660ec013d67a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kKDH_Zwhs7fhB09C7rXcLKAhJEE.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\kKDH_Zwhs7fhB09C7rXcLKAhJEE.br[1].js.WNCRY
        • Size 100KB
        • SHA256 514efd4f3bf3e0d34d2c769b37dd239f1e6e506c344cbf4f4764d89fa790b352
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nqCMVneqreK-vgoiiO8O6mngB9E.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\nqCMVneqreK-vgoiiO8O6mngB9E.br[1].js.WNCRY
        • Size 135KB
        • SHA256 ed94bdf1294234b77886508073e9a143608a039eaff04c2903beb615afa18685
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sGpYN-m0KMWCBkdAq1ExBhpfbbU.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\sGpYN-m0KMWCBkdAq1ExBhpfbbU.br[1].js.WNCRY
        • Size 2.3MB
        • SHA256 6717b6984f862d52a5e444df93959100d7a0d213e8f4e0574637689640afb914
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tgVYEgDzrpTeICVaaRca7RC5Qpo.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\A8X5583U\3\tgVYEgDzrpTeICVaaRca7RC5Qpo.br[1].js.WNCRY
        • Size 1KB
        • SHA256 6035c299ca5bda1f13cc1833b1862327529ab3806bc0463d4375a352e3b32cd1
        • MD5 SHA1 SHA512 TLSH

        ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6MJR4FEF\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js.WNCRY
        • Size 20KB
        • SHA256 56eac30ab3fde46c3c1db7be1d72f8fdab134460066877c9fe7753e964e6a2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.0.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{35a851df-4ae0-4e18-b04f-5275460dae81}\0.0.filtertrie.intermediate.txt.WNCRY
        • Size 30KB
        • SHA256 ba2d50f4fe4a77c799711b1c9f672b0ffdf2e3b6acc7011c0084d5697f806dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.1.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{35a851df-4ae0-4e18-b04f-5275460dae81}\0.1.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 6d131c42b11bc169ab0e7a3e9f09a0d210eb4bd9a0c61a7e8bc416e847529d38
        • MD5 SHA1 SHA512 TLSH

        0.2.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{35a851df-4ae0-4e18-b04f-5275460dae81}\0.2.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 b43bc299e42c21dbaee689d2be0de7f236bf14fd894dc8ab1c03cfd2b24ef192
        • MD5 SHA1 SHA512 TLSH

        0.0.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c4882d8-0032-4ede-93c0-6cdd78561423}\0.0.filtertrie.intermediate.txt.WNCRY
        • Size 24KB
        • SHA256 eda66440afa4603bb47ce21843db048716d768f159254d646e02ebdcdd767cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.1.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c4882d8-0032-4ede-93c0-6cdd78561423}\0.1.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 547b666d8c4e789c51c34ef312c271a9b29a0e49d908db62f6fb4d7c6d25c449
        • MD5 SHA1 SHA512 TLSH

        0.2.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4c4882d8-0032-4ede-93c0-6cdd78561423}\0.2.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 301560df80c359c068c8abfb92e9912ad9225b20611c18b00adfc2cc5f3f59b4
        • MD5 SHA1 SHA512 TLSH

        0.0.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b284ef8a-d6fd-4a23-ab17-3cd956bfacb5}\0.0.filtertrie.intermediate.txt.WNCRY
        • Size 30KB
        • SHA256 d02ede92ce73b97184a6bc656213b8760b9d63f1a9120109d23d51f4c8d79bdb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.1.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b284ef8a-d6fd-4a23-ab17-3cd956bfacb5}\0.1.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 6e0a7e8cd73284bea5f83c1c9c96b7dc3b8b26fe25bb5978208f0a066cfd8b1f
        • MD5 SHA1 SHA512 TLSH

        0.2.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b284ef8a-d6fd-4a23-ab17-3cd956bfacb5}\0.2.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 3850e73afeb2ab57ce5ae596cc63fad119fe6c3ab1d2b17556fecfb9cae65986
        • MD5 SHA1 SHA512 TLSH

        appsconversions.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\appsconversions.txt.WNCRY
        • Size 1.4MB
        • SHA256 b5f87d20fb14281d0180ceb80c23740e6fd7471c545655a25ea1d3ec26fc3961
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appsglobals.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\appsglobals.txt.WNCRY
        • Size 343KB
        • SHA256 38d3abdf0d86355936b1552c654b1071f04327b0cf2a0dd1cb053de9b5b1b1ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appssynonyms.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\appssynonyms.txt.WNCRY
        • Size 238KB
        • SHA256 4ae45f4452275c26c80d3be87f4084c3e15c488a835b1229e3e9044487dd8624
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settingsconversions.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\settingsconversions.txt.WNCRY
        • Size 520KB
        • SHA256 b09dd021feddf75e4266e7a12ebde9fc8bab043ea0b173227e6f471c9b3d8b5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settingsglobals.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\settingsglobals.txt.WNCRY
        • Size 43KB
        • SHA256 165dbe01dd51fce1c7ce9ee3c103f2c0546500e6dd19b6a801439445cfd9e47e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settingssynonyms.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{3348f5dd-89e7-4786-81f1-4d73111c4ff2}\settingssynonyms.txt.WNCRY
        • Size 101KB
        • SHA256 8588dfad27b0977f06f79484f7b1f47bb9686d8c2a86a61602e4824b453aa55a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.0.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{848de5b8-a891-46fa-a905-0c510db84c35}\0.0.filtertrie.intermediate.txt.WNCRY
        • Size 204KB
        • SHA256 5c4f7c8274679837d9e0507c7b108036fa7fd1b2e7a09382b5d34694948f0a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        0.1.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{848de5b8-a891-46fa-a905-0c510db84c35}\0.1.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 d60a6859cfc2c39b6f25cd88a5daf7ad93bf442ac3c3105c929070029f39dc40
        • MD5 SHA1 SHA512 TLSH

        0.2.filtertrie.intermediate.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{848de5b8-a891-46fa-a905-0c510db84c35}\0.2.filtertrie.intermediate.txt.WNCRY
        • Size 296B
        • SHA256 36f0226c4b5aa8a57c5120143c97bf51bbde4da1c141fab38d8a8adad2ad1bf9
        • MD5 SHA1 SHA512 TLSH

        AppCache134336128815680612.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336128815680612.txt.WNCRY
        • Size 76KB
        • SHA256 9ebb9f5823fb0ce968adc7bb7cf1903fdceb283fb8ff67e9ff0786fe28d09789
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336129490638841.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336129490638841.txt.WNCRY
        • Size 77KB
        • SHA256 fefa95eb1d1a3d4e3af98ee54fc98849c5a674bad52f564051b420d09aae53c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130060923687.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130060923687.txt.WNCRY
        • Size 77KB
        • SHA256 aae3769ed4a263eaac5e25063f06299d2c45332a10bea975ca223b73dc912673
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130261057374.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130261057374.txt.WNCRY
        • Size 77KB
        • SHA256 8b04957332137d29689e462d9714987133c07e815782366ed80e8b8eb81a6691
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130596461445.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130596461445.txt.WNCRY
        • Size 63KB
        • SHA256 6cf6f07f6fd249900e9cb6b2c352701f7e901b7253a8a13025e490999eb1105f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130609737579.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130609737579.txt.WNCRY
        • Size 63KB
        • SHA256 9538c95af0a628be4abf5eaf6fc9efd2d54934492070ce36b0ba209c3ac1d32d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130664699534.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130664699534.txt.WNCRY
        • Size 53KB
        • SHA256 79b102d7a88fe7189134f6ac3a607cb8968a258c189aa8992ee1e108abc77a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130676120833.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130676120833.txt.WNCRY
        • Size 52KB
        • SHA256 85022b53c413b72b32285af431fa094bb8832c2b4ef1b261e0d6a407a05b97ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130681872761.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130681872761.txt.WNCRY
        • Size 52KB
        • SHA256 1bc9a4fb2fbbf6023c1b2c68f00a3ef890145ec3cce624fd93b72b91c2162d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130686685579.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130686685579.txt.WNCRY
        • Size 51KB
        • SHA256 8a8613c6576cc71ad7146b6fca586668dd5ea4653f091cbe1da8843ea7c560fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130693053972.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130693053972.txt.WNCRY
        • Size 51KB
        • SHA256 582203813f6b97a584e0428379c11d32db91a2f59ecc960c4680cb2edafae300
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130698256669.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130698256669.txt.WNCRY
        • Size 51KB
        • SHA256 564a0496f79936923d90ae86491ad39d546aca14389e44ef11391cd32c4594fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130702188928.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130702188928.txt.WNCRY
        • Size 50KB
        • SHA256 0d02a08c1cf3fb12cb75202191a6722af7c392e8ced69fbaac5ae759de30909d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130706518382.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130706518382.txt.WNCRY
        • Size 49KB
        • SHA256 6ce2c38c125c4462c648a7f731130f638aca4eb718aa5908ed050cd278ec42df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130710936290.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130710936290.txt.WNCRY
        • Size 48KB
        • SHA256 dbd9f9235af16e70b061242e1e65e4c7c930dfb7e6095f9883104b12ad5519b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336130905790847.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336130905790847.txt.WNCRY
        • Size 47KB
        • SHA256 d98b304c21c70135b90e6e28b8495779a9cdb1a7ff959acbecc2c7922012244c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336131702497175.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336131702497175.txt.WNCRY
        • Size 47KB
        • SHA256 f14e2879b367817cf3aea1baeac73b4e9777ea5dfa67ebc455efb3255ec2c808
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336132505896601.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336132505896601.txt.WNCRY
        • Size 47KB
        • SHA256 4e85c015515c20b8af26e1c5ffa1595e8700751c429db63b9f799340762b4366
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336137638609006.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336137638609006.txt.WNCRY
        • Size 48KB
        • SHA256 1720b311521b12efced3a5dc51bbb665783dab4af32f2e28775df3af9c90d9c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336137937527440.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336137937527440.txt.WNCRY
        • Size 48KB
        • SHA256 d6586b9c220008ba3a02cee0ae10d5ad699912d8d7cb85e4753b7c544e096248
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336138238701115.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336138238701115.txt.WNCRY
        • Size 53KB
        • SHA256 391abd3ac5240b8da7345445f07f0d725eb17b790d0c6a0c8fd59a70f244cade
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336138895923419.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336138895923419.txt.WNCRY
        • Size 64KB
        • SHA256 ca5e02b3bb1372f39ce0beed2534b48039227c81a78be19946f1ccb1a97900b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336139339254622.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139339254622.txt.WNCRY
        • Size 64KB
        • SHA256 c1c110c5217d84800e42e85ec0156c024336e68e18804f731219e8e5072bbf40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336139493345898.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336139493345898.txt.WNCRY
        • Size 65KB
        • SHA256 16b2dd714d5cc6822b752e713221b086024e3c68675f3d5cf64b179509bed0e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336140616639628.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140616639628.txt.WNCRY
        • Size 67KB
        • SHA256 ef5a9ec412dd1c0d852b45b82d85903c2013b862d567a34f92ce48e7b79e7de8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336140916055351.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336140916055351.txt.WNCRY
        • Size 73KB
        • SHA256 d3ef4b5c0dd2abe8b9bcc30e606990afa5fb8f9d5768e349683d675e8ef66955
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336141154364829.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141154364829.txt.WNCRY
        • Size 73KB
        • SHA256 284bafd9e9236e74a2cc5dc1b4c7e570ed150b2b989455f33a2a78dea0a490e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336141216036060.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141216036060.txt.WNCRY
        • Size 80KB
        • SHA256 b55c2b9285236fe4c9f14ed3dd6ddeb6c70159e5bf146f2e3373686e7aee599d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336141543496929.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141543496929.txt.WNCRY
        • Size 80KB
        • SHA256 b7d2b321ddee4d1349dffac97f71855f605283acbede713718f14b1feea64dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336141837816146.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336141837816146.txt.WNCRY
        • Size 82KB
        • SHA256 632ae6d4f3c786f0b2ad3f275034213bf61118318543328a0f7ba41f3e274a10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336142138127829.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336142138127829.txt.WNCRY
        • Size 83KB
        • SHA256 ca9493d69bad710ee26a32d035e67f2ad861e9d94b6f7b184fdadd318f795d92
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336143383196413.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336143383196413.txt.WNCRY
        • Size 83KB
        • SHA256 ceb44d6f2a7ec39b21e2b8d7f1ee7588005ba4998ae369f0043eae9ccf399691
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336173798698688.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336173798698688.txt.WNCRY
        • Size 83KB
        • SHA256 8a2c693d81a8d69928fd03e760e68280c4a2d3ea7e4dacb610aa06562ad40cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppCache134336174098832971.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134336174098832971.txt.WNCRY
        • Size 83KB
        • SHA256 7933c991718878ccb6da1bd97d2574824449c2169d477c124c138f10986f3835
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SettingsCache.txt.WNCRY

        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY
        • Size 670KB
        • SHA256 a7b14050f2a2da1e27291234e7cf67a8587e6681cc0d3312fcc5cc1e793460cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        00000000.res

        • Path C:\Users\Admin\AppData\Local\Temp\00000000.res
        • Size 136B
        • SHA256 93d1ede52fafab52f84e47944f074c7eede4de0aeeb783116d7ea0652603eff7
        • MD5 SHA1 SHA512 TLSH

        48.WNCRYT

        • Path C:\Users\Admin\AppData\Local\Temp\48.WNCRYT
        • Size 77KB
        • SHA256 1c2eafa944ba66d1632664c03554955569e9c70150530e6b220f3b195e865d7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        52.WNCRYT

        • Path C:\Users\Admin\AppData\Local\Temp\52.WNCRYT
        • Size 52KB
        • SHA256 465e90f6a4f15d766369ea6344e6c53d79879baa9f6615827dbb7456b1509bdb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        6741794669899.bat

        • Path C:\Users\Admin\AppData\Local\Temp\6741794669899.bat
        • Size 340B
        • SHA256 4e25c23aa5babc853889d3e1e79bb01ca7650837b250314a8d50f2e2c4b6730f
        • MD5 SHA1 SHA512 TLSH

        68.WNCRYT

        • Path C:\Users\Admin\AppData\Local\Temp\68.WNCRYT
        • Size 64KB
        • SHA256 2b458c48dd20870bb817ae588b91d422cfa27e4610175348e98cdabf7dbfe76e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        73.WNCRYT

        • Path C:\Users\Admin\AppData\Local\Temp\73.WNCRYT
        • Size 80KB
        • SHA256 118220ef22e62fefd24cfd294a052cfbfc2e1849e06987373bcb4223674b5dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        78.WNCRYT

        • Path C:\Users\Admin\AppData\Local\Temp\78.WNCRYT
        • Size 83KB
        • SHA256 eb2741e483aea6092e7385d7391a2022b85f8c829878106f502294c37c7b1783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
        • Size 933B
        • SHA256 0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
        • MD5 SHA1 SHA512 TLSH
        • Path C:\Users\Admin\AppData\Local\Temp\@[email protected]
        • Size 1KB
        • SHA256 e23f63d683e740a77c9c607c6dcb8cd9ccd5ddbd445099995fa19964cd12f304
        • MD5 SHA1 SHA512 TLSH

        SSLEAY32.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\SSLEAY32.dll
        • Size 694KB
        • SHA256 bd70ba598316980833f78b05f7eeaef3e0f811a7c64196bf80901d155cb647c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libeay32.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll
        • Size 3.0MB
        • SHA256 58be53d5012b3f45c1ca6f4897bece4773efbe1ccbf0be460061c183ee14ca19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libevent-2-0-5.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
        • Size 702KB
        • SHA256 77a250e81fdaf9a075b1244a9434c30bf449012c9b647b265fa81a7b0db2513f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libgcc_s_sjlj-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
        • Size 510KB
        • SHA256 9aeccf88253d4557a90793e22414868053caaab325842c0d7acb0365e88cd53b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssp-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
        • Size 90KB
        • SHA256 f28caebe9bc6aa5a72635acb4f0e24500494e306d8e8b2279e7930981281683f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        taskhsvc.exe

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
        • Size 3.0MB
        • SHA256 e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
        • Size 105KB
        • SHA256 66d653397cbb2dbb397eb8421218e2c126b359a3b0decc0f31e297df099e1383
        • MD5 SHA1 SHA512 SSDEEP TLSH

        b.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\b.wnry
        • Size 1.4MB
        • SHA256 d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        c.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\c.wnry
        • Size 780B
        • SHA256 079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
        • MD5 SHA1 SHA512 TLSH

        m.vbs

        • Path C:\Users\Admin\AppData\Local\Temp\m.vbs
        • Size 219B
        • SHA256 7fbdc49f4b4ba21949eca0b16c534b4882da97e94e5ca131cec1629e60439dfa
        • MD5 SHA1 SHA512 TLSH

        m_bulgarian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry
        • Size 46KB
        • SHA256 40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_chinese (simplified).wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry
        • Size 53KB
        • SHA256 845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_chinese (traditional).wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry
        • Size 77KB
        • SHA256 5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_croatian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry
        • Size 38KB
        • SHA256 3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_czech.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry
        • Size 39KB
        • SHA256 5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_danish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry
        • Size 36KB
        • SHA256 a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_dutch.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry
        • Size 36KB
        • SHA256 2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_english.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry
        • Size 36KB
        • SHA256 26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_filipino.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry
        • Size 36KB
        • SHA256 d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_finnish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
        • Size 37KB
        • SHA256 1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_french.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry
        • Size 37KB
        • SHA256 9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_german.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry
        • Size 36KB
        • SHA256 2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_greek.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry
        • Size 47KB
        • SHA256 e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_indonesian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry
        • Size 36KB
        • SHA256 23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_italian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry
        • Size 36KB
        • SHA256 49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_japanese.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry
        • Size 79KB
        • SHA256 7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_korean.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry
        • Size 89KB
        • SHA256 552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_latvian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry
        • Size 40KB
        • SHA256 a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_norwegian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry
        • Size 36KB
        • SHA256 cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_polish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry
        • Size 38KB
        • SHA256 519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_portuguese.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry
        • Size 37KB
        • SHA256 bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_romanian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry
        • Size 50KB
        • SHA256 70c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_russian.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry
        • Size 46KB
        • SHA256 02932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_slovak.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry
        • Size 40KB
        • SHA256 e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_spanish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry
        • Size 36KB
        • SHA256 72f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_swedish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry
        • Size 37KB
        • SHA256 146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_turkish.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry
        • Size 41KB
        • SHA256 6db650836d64350bbde2ab324407b8e474fc041098c41ecac6fd77d632a36415
        • MD5 SHA1 SHA512 SSDEEP TLSH

        m_vietnamese.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry
        • Size 91KB
        • SHA256 1f21838b244c80f8bed6f6977aa8a557b419cf22ba35b1fd4bf0f98989c5bdf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        r.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\r.wnry
        • Size 864B
        • SHA256 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c
        • MD5 SHA1 SHA512 TLSH

        s.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\s.wnry
        • Size 2.9MB
        • SHA256 e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        t.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\t.wnry
        • Size 64KB
        • SHA256 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        taskdl.exe

        • Path C:\Users\Admin\AppData\Local\Temp\taskdl.exe
        • Size 20KB
        • SHA256 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        taskse.exe

        • Path C:\Users\Admin\AppData\Local\Temp\taskse.exe
        • Size 20KB
        • SHA256 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        u.wnry

        • Path C:\Users\Admin\AppData\Local\Temp\u.wnry
        • Size 240KB
        • SHA256 b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CloseSearch.pps.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CloseSearch.pps.WNCRY
        • Size 1.1MB
        • SHA256 0d5a73eb7a2fe105a8f85987485ed8b80f7d1e7f82897bfbe716acf7f23d0083
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockRepair.zip.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\BlockRepair.zip.WNCRY
        • Size 1.6MB
        • SHA256 1105fc45f375e3926e646d2213bd216f964a799d2b0e72d442fcd1fdabd4df22
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToSync.docm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\ConvertToSync.docm.WNCRY
        • Size 719KB
        • SHA256 7326f3e7a49e71e7948806aa5fbe6bf1a1379a8dd469213fff3d4b893dee78ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DenyWatch.ps1.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\DenyWatch.ps1.WNCRY
        • Size 769KB
        • SHA256 861d187ffeecdc071e795ae526dab578c14e4bb0987cc9bc1fccd37cac6f7512
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableProtect.jpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\DisableProtect.jpeg.WNCRY
        • Size 1.0MB
        • SHA256 caee4b136a0f7f7f4d9ab49ed36358245aa78f01e790a81b40cef2d5bcaddb28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExitCheckpoint.docm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\ExitCheckpoint.docm.WNCRY
        • Size 818KB
        • SHA256 27dfd40c214c16b618f5624aba8df1b6f34e909a6c9d68b4b75dc5f746f8ee84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveInitialize.mid.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\RemoveInitialize.mid.WNCRY
        • Size 917KB
        • SHA256 3ced5da582639e061586d1d84bfcf7972aa299824e15eda49171e4e2e58095f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestartPing.mov.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\RestartPing.mov.WNCRY
        • Size 521KB
        • SHA256 140a005ac9d7d3d6a508b93dc4b0e70b3795ff06b6f89ed9fa4e895664fe9e46
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResumeExport.asf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\ResumeExport.asf.WNCRY
        • Size 967KB
        • SHA256 933349352de5abd0cd5de916154909190b5f1ceb2110ca927a11ad56470d71e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SkipPing.mp4.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\SkipPing.mp4.WNCRY
        • Size 620KB
        • SHA256 b9df8a12f4b48a3f461f83ab05241ad6bec99ab3f0059c85c21b8cd9f2132be1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SubmitDisable.rtf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\SubmitDisable.rtf.WNCRY
        • Size 1.1MB
        • SHA256 9217dfc01479d3921e0560c269fb8b40168f32b0ead3b7b130c9dce5ca431b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TraceInvoke.xlt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompareSync\TraceInvoke.xlt.WNCRY
        • Size 1017KB
        • SHA256 d215b418fbc0d6eb7ead30544efc3d5446b7f457e8da44dc591e82ac2e0d024d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ClearSend.php.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\ClearSend.php.WNCRY
        • Size 402KB
        • SHA256 4371b4ad633de7353bd505236ac929b8881f2f8246a61d84e29bb8f95671d038
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertExpand.zip.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\ConvertExpand.zip.WNCRY
        • Size 368KB
        • SHA256 6f1896a7cd3f5ee4f332704e8d03c9b483b1f87790157b7ddfbd086053e8aa2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertSend.rtf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\ConvertSend.rtf.WNCRY
        • Size 216KB
        • SHA256 ab5bf97972fc2a8e4c5fb845e419e568e10a6609e30bccb7c0f4f29d3c94a332
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetStop.vsdx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\GetStop.vsdx.WNCRY
        • Size 139KB
        • SHA256 8cd716bc71f2dd79cabf9fee5b8ef2485cf99f1fad37a1d342fd174ef39fe3b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GrantStep.cmd.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\GrantStep.cmd.WNCRY
        • Size 334KB
        • SHA256 b37f3e6daecc054eaa80b0273aa325b2c55cfa000323cbc00320287ea7eeeb97
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OptimizeHide.txt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\OptimizeHide.txt.WNCRY
        • Size 326KB
        • SHA256 9542ba7235dbf491bf1addd9b266a89e43c0b84289e370b0bdeedfd95aa85355
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopMove.gif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\PopMove.gif.WNCRY
        • Size 300KB
        • SHA256 4bb7f37acbadbe446e286d86e4eb617775820216354a4077b874eb63bb08996b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReadSkip.wma.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\ReadSkip.wma.WNCRY
        • Size 550KB
        • SHA256 d8f60e77310a8782aae95188b4b1661791d2a4d02767d3bdc895eb3ead9a7d10
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestoreNew.docm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\RestoreNew.docm.WNCRY
        • Size 292KB
        • SHA256 7d90fbd7c36878d89cfece9f4438dc721892894f64b48f32d2c2dee3c0edd057
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SearchRegister.jpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\SearchRegister.jpeg.WNCRY
        • Size 343KB
        • SHA256 c918a93bc777851006649806ea7c359932352691c3d1349e89a43d6e257b6bad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopConvert.3gp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\StopConvert.3gp.WNCRY
        • Size 258KB
        • SHA256 2a562d18597d45a2283794376f6be50f9f48a86b16e444fd1f1f63c5be88fad6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SubmitGrant.txt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\SubmitGrant.txt.WNCRY
        • Size 207KB
        • SHA256 7e91abf3cb68fc708228aa644782b0ac10fea1e00caa78005fa56c112da13f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SuspendUnprotect.pptm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\SuspendUnprotect.pptm.WNCRY
        • Size 309KB
        • SHA256 825870cdcc39ef3491acc649f2f03955633256827907b4cdb5aa28d484e09738
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchExport.wav.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CompressReset\SwitchExport.wav.WNCRY
        • Size 224KB
        • SHA256 33adb4bc0bcc67226492894c3472151e67b1a05257adf28b19eb211d9e0184ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertFromResize.ps1.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\ConvertFromResize.ps1.WNCRY
        • Size 357KB
        • SHA256 d9c1bdd568594cc3eaa5d277feaca0431a7a28c34ef2ed95492bfe85f374c71f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertSend.pdf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\ConvertSend.pdf.WNCRY
        • Size 632KB
        • SHA256 11da64f70dc8139cc05689b4e2785f3bb0a3f83ae7c484f44745a39f028dacd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToHide.pptx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\ConvertToHide.pptx.WNCRY
        • Size 852KB
        • SHA256 020637508c649320b8f94ac11c9035ed120cdf2cb00da331c86c00166b95791d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToUpdate.wav.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\ConvertToUpdate.wav.WNCRY
        • Size 302KB
        • SHA256 7f7c98159937b714320dc5938b157ea30fdfc927952970ab7404f2668af9cd0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExpandOpen.gif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\ExpandOpen.gif.WNCRY
        • Size 660KB
        • SHA256 5c9f16191603f518ddd824fe1b47bb1dcd69ddf8b2879dab66166c97282e32cc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeFind.zip.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\InitializeFind.zip.WNCRY
        • Size 797KB
        • SHA256 f65ff749ea25315868c0d94fb0ec40f5e769938ba5698097f0461be858967473
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PushShow.dotm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\PushShow.dotm.WNCRY
        • Size 522KB
        • SHA256 5ae36ff4185e1fdf307068792fea5e8482c4f527c924bda8f538eac749952164
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TraceUse.dot.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConnectRegister\TraceUse.dot.WNCRY
        • Size 1.2MB
        • SHA256 9b50a66e6a692b2f010b5f049bafefbd2d31831882051dc4ade1e05540188dc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertRead.rtf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ConvertRead.rtf.WNCRY
        • Size 439KB
        • SHA256 8d15b068167af5361b8328d82860d9f6b267ae8d896cfbca4b4db88a7e598429
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertPush.bat.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\AssertPush.bat.WNCRY
        • Size 509KB
        • SHA256 64151f58eadbbe28f9d2811508a3ca1c56c7b10122f30c25806cc225a8ea467e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConnectMount.mp4.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\ConnectMount.mp4.WNCRY
        • Size 470KB
        • SHA256 bd03854465320e1121ed3f3339647f6ed4bca6a6c9e5a6e96b22cafba3cbbc23
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertFromBlock.ppt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\ConvertFromBlock.ppt.WNCRY
        • Size 718KB
        • SHA256 9c5b692cc8fc1091a107722cd41d54e60c9828aebb9ec9081b406bf9fff41aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetRestart.csv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\GetRestart.csv.WNCRY
        • Size 287KB
        • SHA256 e0b7656dc4d6e09cd64c86003be06da14421d6e616fe3c7976938548cdee3ceb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InvokeShow.pot.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\InvokeShow.pot.WNCRY
        • Size 418KB
        • SHA256 1f3690c21bb3a586896b4dffaa63763a9eebcdd39569e47d397f1e867b41a631
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResizeAssert.jpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\CopyRename\ResizeAssert.jpg.WNCRY
        • Size 352KB
        • SHA256 a5435b92eff80aff0124f7d3a01e1036d37513d0c206fa4731706e09621addf1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompleteLock.jpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\CompleteLock.jpeg.WNCRY
        • Size 316KB
        • SHA256 96f2480864d2636eb9342f3aa21b689abe4762844ecda3c45506752f1db01db3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertFromMeasure.zip.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\ConvertFromMeasure.zip.WNCRY
        • Size 225KB
        • SHA256 db32521d219b100774d190c40600cad1f18fb6109cca0e5b53eea4815bfc1f16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InvokeUnblock.mp3.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\InvokeUnblock.mp3.WNCRY
        • Size 336KB
        • SHA256 800e050f2d630956e50e868b2ad56f780c83cf08849dc3ddbd2a7a0832f0d58b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinFind.ppsx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\JoinFind.ppsx.WNCRY
        • Size 175KB
        • SHA256 8e6c772ef1bc316a80d5aae86dc20b09477faea052862bae5ccec73e876b97af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockUnprotect.odt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\LockUnprotect.odt.WNCRY
        • Size 366KB
        • SHA256 d498b31cfeb45d2eef81cfefec0d3d248ad406478ee01194efd893e5ac0e712b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopWatch.rtf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\PopWatch.rtf.WNCRY
        • Size 276KB
        • SHA256 747d6a9b8451179c427a6557aa2dc03d741dbc070252a547cf8e3d1c87d22971
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterGet.tiff.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\RegisterGet.tiff.WNCRY
        • Size 692KB
        • SHA256 4efe639f142cc0a4d34b5d9916ced8fa8787c58fadd4c97ced6dc79a4871890d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveProtect.odp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\RemoveProtect.odp.WNCRY
        • Size 306KB
        • SHA256 8039637b0b74d0e580ed9c6507a602a1fb349135d338d1692170c1ffe933187c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RevokeDisconnect.png.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\RevokeDisconnect.png.WNCRY
        • Size 466KB
        • SHA256 dda65aad897847791465f45ae3fc0ca32f76f6ebb7fb44829b5d5c0c9ed04205
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SelectSwitch.3g2.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\SelectSwitch.3g2.WNCRY
        • Size 236KB
        • SHA256 58abd4559f1b39c6b6b5b4330ba2b0a8c6c14a5bb0c6ab30c3622e83296bff5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoDismount.gif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\UndoDismount.gif.WNCRY
        • Size 476KB
        • SHA256 e8d6ac0cf431804cee9f823275f93bdd482ee7462cb403b18e31696581751288
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnprotectImport.mp4.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DebugApprove\UnprotectImport.mp4.WNCRY
        • Size 416KB
        • SHA256 c59542b88bc517bb07b9a08da212990ff78e46541d1556e7ac79e0e196390b58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountUninstall.avi.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\DismountUninstall.avi.WNCRY
        • Size 522KB
        • SHA256 eac38be9bb219289c741e1d10a2202787ee66b0d496cef2eba5c3b2c5be8870b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToCheckpoint.m3u.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\ConvertToCheckpoint.m3u.WNCRY
        • Size 491KB
        • SHA256 f91683817b8d475c710588431e4859db6443936e960cc330f12d7652d61df226
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugPop.asp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\DebugPop.asp.WNCRY
        • Size 345KB
        • SHA256 dbc2db37102f7189108b064deca1c8cc579bb1f17edbb7d8b98ca5c4ea458329
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugStop.mpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\DebugStop.mpeg.WNCRY
        • Size 616KB
        • SHA256 62b35f27aa97e6b443bd21aaa76581e7e2080a366b3c29c6b77a6a66bfffecc7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveTest.bmp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\MoveTest.bmp.WNCRY
        • Size 407KB
        • SHA256 e5c0aea1fd7b6a06fdc16a13d2981428b18c658ba5efe761cf1657f513ba537c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NewStop.xlsx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\NewStop.xlsx.WNCRY
        • Size 324KB
        • SHA256 cd9dc584a5036d736598619c33d37f5548bb304e6e1dd9cfa19445efc0a533bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopRequest.xlsx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\PopRequest.xlsx.WNCRY
        • Size 595KB
        • SHA256 62702d96d1566fd558dbd69d7b73b8b1d668ea1d250c0f2aaa89fe48993ed20e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RequestBlock.docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\RequestBlock.docx.WNCRY
        • Size 554KB
        • SHA256 9dbd81a78ca6142f28259897222c6c31b5c8aa29ab535f043df6c400375e16f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendSubmit.xltx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\SendSubmit.xltx.WNCRY
        • Size 240KB
        • SHA256 ebb25098f073dfe80b1d723ad36bf8dd053be7dfd25978fdecce5dbda5007216
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestGroup.xlt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ExpandRead\TestGroup.xlt.WNCRY
        • Size 512KB
        • SHA256 24eb45ac2226822d4f0e634871b498f3a7adca923da6d0624b75294d09e4b4c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FindRename.tif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\FindRename.tif.WNCRY
        • Size 1.0MB
        • SHA256 7b8a3a1c691782dd7bdf70a2ec4f9d25d9bd72d68fd7d53863c869ddd9d6222d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountMeasure.docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\DismountMeasure.docx.WNCRY
        • Size 640KB
        • SHA256 6c14bb9939405522e0b76b1038b9ec8f24c1cc6ff9b52b9f9d22dead883838e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InvokeUnprotect.wmv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\InvokeUnprotect.wmv.WNCRY
        • Size 384KB
        • SHA256 bb337aaea343e4303278c0860b3923e720b248ac90cb2b52e0c5738b7157def8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestartClear.cmd.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\RestartClear.cmd.WNCRY
        • Size 256KB
        • SHA256 e168ff85f09c641221d9dc87e5ad10711db9d5f8381167c7ab07f093c197aea4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SaveResolve.asp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\SaveResolve.asp.WNCRY
        • Size 682KB
        • SHA256 fa4193d5acc7132fbd9b8769fca30b55442a58185642484dac8bdc1d8640389a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnblockExit.mpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\UnblockExit.mpg.WNCRY
        • Size 597KB
        • SHA256 1ad97799c926d3454f15523ca569cc60e62c3d95f16680d5958633ff8bdcc29b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UsePublish.wav.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\GetEdit\UsePublish.wav.WNCRY
        • Size 469KB
        • SHA256 fd4ea474d402031e3197069d47357eff181fa12b78dbb8c898536fdcab1ca523
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeWait.mov.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\InitializeWait.mov.WNCRY
        • Size 857KB
        • SHA256 2eca83cede9aa8b75eb7fcb3146c3cd98f7fecd48f5ac9016854b192d23cebe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        HideTrace.mov.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\InstallPublish\HideTrace.mov.WNCRY
        • Size 1.2MB
        • SHA256 624b472f8bc123a13e3d341ab9ca37720615b54486c9ef3fcb4c9d5e13d63752
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResizeDisconnect.wmv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\InstallPublish\ResizeDisconnect.wmv.WNCRY
        • Size 800KB
        • SHA256 57b825c09dd589a7d183be92b655a16844102b14ec6811fa8e5db34e29ae954e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnlockEnable.asp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\InstallPublish\UnlockEnable.asp.WNCRY
        • Size 740KB
        • SHA256 c3f584d01c4dc13cd129bbb2325d9515726742d189d8d031fc2010c1bb553dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WatchConvert.pdf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\InstallPublish\WatchConvert.pdf.WNCRY
        • Size 859KB
        • SHA256 68da6b243ca50ae9f87ccdeafee2706b6bca82c605b6ac1adbbbf0e50ff60055
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TM01840907[[fn=Equations]].dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WNCRY
        • Size 50KB
        • SHA256 6eb52d05822ad7b233b4e29243fcf20679f380103e2165d1c62899c4b97352ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY
        • Size 46KB
        • SHA256 6b2881ad188a2d4ee9dcc867f89d381e928504a133f9ca574942f8a27bcd4fbd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TM03998158[[fn=Element]].dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WNCRY
        • Size 33KB
        • SHA256 5b1008b0372af5859b3a47c66a1a3cc0bc3551e99e3937584e2db9d0dfb2ba37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TM03998159[[fn=Insight]].dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WNCRY
        • Size 3.3MB
        • SHA256 768766c5bdb3dee2534bc7d2ae1c3820d50defe317523bfd77dd1d832c79cbdd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Normal.dotm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRY
        • Size 18KB
        • SHA256 f5157e391c147368cffbac9a78f5f0382b4540837e7b0bf03b818f28741d788d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CachedImage_1920_1080_POS4.jpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRY
        • Size 76KB
        • SHA256 7fab4c3ec3893bf4f065b538235de7338ad97b528de30840862fd0960164d649
        • MD5 SHA1 SHA512 SSDEEP TLSH

        prefs.js.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\kj0thzcj.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.js.WNCRY
        • Size 776B
        • SHA256 cd9d2b53c530559efb2bd857770bd20a4bff10c15ab1b1f7d947c4937f7b2b8e
        • MD5 SHA1 SHA512 TLSH

        cert9.db.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\cert9.db.WNCRY
        • Size 224KB
        • SHA256 c2cc909511cd21a0ee9a90be799e75644a89f248147b16fa3e2c5256a0fac4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        key4.db.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\key4.db.WNCRY
        • Size 288KB
        • SHA256 85b81707ee0a9cd667a02b8709e59727a40556ac21472fc646e7ba5b971bda12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkcs11.txt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\pkcs11.txt.WNCRY
        • Size 808B
        • SHA256 69e5a00acad8b022bbd5a07bd87e8b0fd4872c619ee0f642bd8e664d0ae24d8e
        • MD5 SHA1 SHA512 TLSH

        prefs.js.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\16h2m5ny.default-release\prefs.js.WNCRY
        • Size 7KB
        • SHA256 6c5b28c9fb53e1574a8726322fdaa637e008fcff11cc85dd1747ecf8ad1a6cad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        user.js.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xlhu326a.Admin\user.js.WNCRY
        • Size 536B
        • SHA256 efddc90f5732bf15622de00c70a0a6f2aaba76645be89a884044fb8d218ca540
        • MD5 SHA1 SHA512 TLSH

        SplitLock.wma.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\OutFind\SplitLock.wma.WNCRY
        • Size 952KB
        • SHA256 58a6cfa07a9c2541fab6059f6629b4eabcf49b8a625f81469cb230bb22525d69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopInstall.ppsm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\OutFind\StopInstall.ppsm.WNCRY
        • Size 2.1MB
        • SHA256 de6dfb8b7d234c9ec4c8be2b87c65527e43171b871a608c56a683bf4113c83c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopPublish.bmp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\OutFind\StopPublish.bmp.WNCRY
        • Size 1.3MB
        • SHA256 c89ba236033da8ab7fd118241ddaa4f24c8733a6a93a5453639476f9a6f643c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UpdateStop.mpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\OutFind\UpdateStop.mpeg.WNCRY
        • Size 1.1MB
        • SHA256 dd3eb4ae12b2741dcda5f5171cf0a6c670dc9d93f215d271764920733f5ad2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ApproveDeny.tif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\ApproveDeny.tif.WNCRY
        • Size 261KB
        • SHA256 fbdeee8320b20cd05daefca169fb807b1ecf595b94c62b30adf1db5edf841bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ClearExit.dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\ClearExit.dotx.WNCRY
        • Size 359KB
        • SHA256 41d6939c98991c9c101e7c73f2ea5a2473c87903df6a87958c72fc1727da8f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ClearTrace.docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\ClearTrace.docx.WNCRY
        • Size 374KB
        • SHA256 af644ff0a8ec3f76583a19c3eb2c4af2876b5c24580f076eb486b514cf88d0cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DenyUse.jpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\DenyUse.jpeg.WNCRY
        • Size 585KB
        • SHA256 5d7dc3b8cd9448f10b7d2465b4bb2565f5dcca83268e3d56dd9041ca6c711998
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountCompress.mp3.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\DismountCompress.mp3.WNCRY
        • Size 515KB
        • SHA256 660c142f0337a2135fa86acf9ed2490508f2c7591be1ba1a2f262c9e0f69cc43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializePop.odt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\InitializePop.odt.WNCRY
        • Size 402KB
        • SHA256 36055bee823b002e5203ec3acc01c3726464166b79e66ebf2647b54ba1eb8556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MeasureStart.potm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\MeasureStart.potm.WNCRY
        • Size 529KB
        • SHA256 b8b5de1d5124627377241a0ced648c5a8492e9b0d1b00eaa62f77b2119308df4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveInvoke.ppsm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\MoveInvoke.ppsm.WNCRY
        • Size 416KB
        • SHA256 2dad914f6b5717f890f5b3e478c0c347a31372f63dca0198dac7966c96a4dd50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OptimizeBackup.odt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\OptimizeBackup.odt.WNCRY
        • Size 500KB
        • SHA256 3406ecf13df9169558f8e0e96226aeb04fe83360ef0812874d72d00e1142e00b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveConvertFrom.dot.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\RemoveConvertFrom.dot.WNCRY
        • Size 571KB
        • SHA256 a43dc51cf0e2456fe1a0717092157dac481bd179f136bccd686d0e5d546c9bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveUninstall.svg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\RemoveUninstall.svg.WNCRY
        • Size 317KB
        • SHA256 3f71cafa461fbd63813f6fc65744422bc444f7f558bfe2702c9df991895da6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RequestPush.m3u.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\RequestPush.m3u.WNCRY
        • Size 458KB
        • SHA256 3170c9ab371362fcfdc5ef442605cb9be28293da9609c242ee48d83f58e35ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SkipWrite.docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\SkipWrite.docx.WNCRY
        • Size 289KB
        • SHA256 626620e4c387640c1b9c9c6888aaddf054b36b443e8fd50b852ef31ea2492b9b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StartDismount.wmv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\StartDismount.wmv.WNCRY
        • Size 543KB
        • SHA256 62aae1ee0949d09ea99a1e5840c03c11f0d8664b3de3b3fbe831ef06f2b26cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopWait.docm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\StopWait.docm.WNCRY
        • Size 656KB
        • SHA256 a9a5e41887d5ce1e2f6cdbcf4621003e828edf499b07459fd90247d3f3b62e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchResize.zip.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\SwitchResize.zip.WNCRY
        • Size 247KB
        • SHA256 f72f83e049bc35cd449c496deb3a75f2e45947a9db227de0fd1d334442bef9dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SyncGrant.vsdx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\SyncGrant.vsdx.WNCRY
        • Size 486KB
        • SHA256 9d2df505c2b29a18ecfea89762117c655b5ba6aaa7fae936c5586086d4e1d039
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestImport.docx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\TestImport.docx.WNCRY
        • Size 233KB
        • SHA256 dda84581d9d522c3f3b5a37ee5df8d9cf7ef13ebf90b5c081ee91555b0515d75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoCheckpoint.asf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\UndoCheckpoint.asf.WNCRY
        • Size 430KB
        • SHA256 b97f220130cbe87aaf6a207c159b4f4032eef7cef4b6d6b6a254475a34fe45df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UninstallSkip.jpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ReceiveUnlock\UninstallSkip.jpg.WNCRY
        • Size 557KB
        • SHA256 d7ba0c119244c4888096fb05797fd8fe5b2cc799739a8ecb875c86dd81ddbfd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmResume.wav.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\ConfirmResume.wav.WNCRY
        • Size 343KB
        • SHA256 cb432d7965e5457c98db37a0046346b2ff20387fe645caf4bfea39d4b5136bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertExpand.tiff.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\ConvertExpand.tiff.WNCRY
        • Size 266KB
        • SHA256 b2c89e7dd8e9c6646560005eca6f93200c3aef3cd5722bcb8cb19d539652f590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisconnectAdd.mpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\DisconnectAdd.mpg.WNCRY
        • Size 165KB
        • SHA256 7b8c7b682a47e45fdef949647ab26e00dc2c0218c91ecddfde7c6edd031dff37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountSubmit.7z.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\DismountSubmit.7z.WNCRY
        • Size 139KB
        • SHA256 65f854fe8dd1d9cdd0395fe57f54ac8e3f34c5a1317b48c9890c6142630447f5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EnableInstall.jpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\EnableInstall.jpg.WNCRY
        • Size 207KB
        • SHA256 f74f34745f40f9e90780caa29f32fe879e03490617180567a2db3ebe79430c39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeOpen.doc.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\InitializeOpen.doc.WNCRY
        • Size 275KB
        • SHA256 5f2a261eb827c44964ae91be589d7cf5dfd63263bfd6fba409997d1042fa094a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinOpen.xlsm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\JoinOpen.xlsm.WNCRY
        • Size 233KB
        • SHA256 2dcb780dbf800b270573f16d5ec29ef3b39ca8a56dab3cc2b6389382f7c9d2a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenEnable.wav.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\OpenEnable.wav.WNCRY
        • Size 359KB
        • SHA256 95f095c84f17d3b39e711e4ce35ba20cd13ea3ab522d00d31657d4b6c3a508bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopConnect.ps1.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\PopConnect.ps1.WNCRY
        • Size 182KB
        • SHA256 71ce4b1e3f345c783c520e800f0b3aa20c85e759da4ad9127c2f087c3934a063
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PublishUpdate.iso.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\PublishUpdate.iso.WNCRY
        • Size 156KB
        • SHA256 9b3b4e436d2352cd67d41552d22964758ae0255ce6db41c192d77be06550b727
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReceiveSync.dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\ReceiveSync.dotx.WNCRY
        • Size 317KB
        • SHA256 43fc9f4d5085fb4dc1c6eaa37dd49c5f9923f4d96537b1ca360239b754d7627a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterCheckpoint.rtf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\RegisterCheckpoint.rtf.WNCRY
        • Size 309KB
        • SHA256 ccc7fc6970b555d8cf9afb6a7f8cb06045db921c933d1005f0e6bd4c315899e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResizeJoin.ps1.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\ResizeJoin.ps1.WNCRY
        • Size 368KB
        • SHA256 8a49c105c4dd6fecfdfae486d232d9664f268cfa76f6d9aa668d7887c983cd7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StepEnter.gif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\StepEnter.gif.WNCRY
        • Size 385KB
        • SHA256 bdb0eadc1022a6e7230b50648227ee987e5f0a5abf5600e406c0f60a18610340
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestCopy.iso.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\ResetConvertTo\TestCopy.iso.WNCRY
        • Size 550KB
        • SHA256 5b5c50aae212197d2f2122d0dc6427084bc08e32f1edb226a60b3de994f022b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SetSync.dwg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\SetSync.dwg.WNCRY
        • Size 898KB
        • SHA256 cb70986512e85ddf2baba5d73e15d388f15c8fcf29ba2fb8c75e478476fe1a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoPop.bmp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UndoPop.bmp.WNCRY
        • Size 1.2MB
        • SHA256 6bbe8d4e9a06ef3b362e7b589488671d03f531dce5c14c105581d63c5bfbeb02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ClearMove.asp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\ClearMove.asp.WNCRY
        • Size 513KB
        • SHA256 cf62bbcf5771d5eb1ce1043fdd901a02f6b3d56a46f92fe49ccee58e58eb65ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugInstall.mpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\DebugInstall.mpg.WNCRY
        • Size 306KB
        • SHA256 404c45d803db788b35c249631db488ad607cb85ac469f31a3bc76c8732316176
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableDismount.xlsx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\DisableDismount.xlsx.WNCRY
        • Size 476KB
        • SHA256 53d35f60c33bb8591838f2cc4c9671bab62d57c73303b0c41784927bb76b72c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableImport.3gp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\DisableImport.3gp.WNCRY
        • Size 334KB
        • SHA256 0ca5ed12127bcb351e33fcd026929175ef2564f8cdbce1e81d4d7306b235e0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableSave.mp3.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\DisableSave.mp3.WNCRY
        • Size 466KB
        • SHA256 82a877b483e5fc12fc3398ffcdb508f387314c144cca19c12b636bfbeb96b96d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockNew.dotx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\LockNew.dotx.WNCRY
        • Size 184KB
        • SHA256 822a99515326cd1f2b9278342f81a8e8e85e9835ccd99de65e32e279cdef3451
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MountOut.tif.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\MountOut.tif.WNCRY
        • Size 250KB
        • SHA256 cf394be02e559932ec316a6e367ca4f4c600fa993d03545b87b35a357d1794d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PopRead.txt.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\PopRead.txt.WNCRY
        • Size 504KB
        • SHA256 eed12b93ac925e4e40d1446d0de553408a6031bf347bde58a62ac504ebe8a75e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReadRename.xlsm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\ReadRename.xlsm.WNCRY
        • Size 202KB
        • SHA256 6d2e7d956fb13a27c740b3159a6c217cb8075a7fd167b6bf4cc755a9d1d4723a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReceiveResume.xls.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\ReceiveResume.xls.WNCRY
        • Size 438KB
        • SHA256 e96bc6b7910c3cc39a3688d66ab867f9a3d356f5fe90ec2d6d12a06acfe8094f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveClose.xltx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\RemoveClose.xltx.WNCRY
        • Size 532KB
        • SHA256 7e4993c8ed24e0efb00358b6ea0750da8bbdf11471881195deb67f5e42f87e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResumeResolve.3gp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\ResumeResolve.3gp.WNCRY
        • Size 193KB
        • SHA256 51a8e0ba4c2e3c8da6faa073f1d1fdb8e68c2d5bf29acbcacc9bd69c6e941896
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SubmitPush.js.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\SubmitPush.js.WNCRY
        • Size 221KB
        • SHA256 63dc3378430ff41bc2dc273d6ae74065134273766e3775f3222307740720f136
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SyncSwitch.odp.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\SyncSwitch.odp.WNCRY
        • Size 448KB
        • SHA256 9b4ed7dc68bb6aa38690dd5ec862f2e47c4e23599db907b5c75425a2da6c8465
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestRegister.rar.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\TestRegister.rar.WNCRY
        • Size 419KB
        • SHA256 07569128be81b660405c97c41feb63e0b5aed5fe2e2bb1536975f9e2fbcf4809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UseConvert.csv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UninstallTest\UseConvert.csv.WNCRY
        • Size 212KB
        • SHA256 b10ff7eab9f4decda453dda273525ad0b6187637a1822861fff73bb8e2c3057c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertMerge.wmv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\AssertMerge.wmv.WNCRY
        • Size 456KB
        • SHA256 d16ab6c1214c7e02e22025851c6f43fc69bbf9979f83cb747e6d8126b2eb2841
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BackupAdd.jpeg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\BackupAdd.jpeg.WNCRY
        • Size 372KB
        • SHA256 77fc176eea43fe676bf4f731c7debe88d5c77a07cce8555cf38bf93eaa0e5be1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToCompress.png.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\ConvertToCompress.png.WNCRY
        • Size 274KB
        • SHA256 786e5c0f7992c60c88758e0c1da086dfb3f63bfe66dfc3dc143f98a276636ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyImport.wma.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\CopyImport.wma.WNCRY
        • Size 288KB
        • SHA256 d743a0bec7b5f2f918c87c631aa5d6ce6e7d0138e9c8e4617b16cd113febd8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugOut.wma.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\DebugOut.wma.WNCRY
        • Size 484KB
        • SHA256 ed2ef7dff0f5b4695d1c2d5f06d6409d600995066899155af1eb52d6446645e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisconnectCompress.csv.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\DisconnectCompress.csv.WNCRY
        • Size 470KB
        • SHA256 878b86cdd4585567526ae7986a07e6c0e51474b5da43704e9ebc191e6cab0396
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FormatRestore.pptx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\FormatRestore.pptx.WNCRY
        • Size 442KB
        • SHA256 7f40d10d28c8bb72595cb45ebf5010b55f126ca2d27ddbe6b1545adf544461a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReadRegister.avi.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\ReadRegister.avi.WNCRY
        • Size 386KB
        • SHA256 7e473aa8fd9cdac0ad824af64fc8f102c10d020f71b99964678e379d0b9e8239
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SkipSync.jpg.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\SkipSync.jpg.WNCRY
        • Size 400KB
        • SHA256 d202767891d1e611ca55b8c1c405d9d2d9de2a3950bd8a68ff1d0c32fd7f6838
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StepMerge.mov.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\StepMerge.mov.WNCRY
        • Size 344KB
        • SHA256 192fc2345d60b14809765cef9247ec22b4d26906882044a0d985c9478dfcaf87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopGrant.vsdx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\StopGrant.vsdx.WNCRY
        • Size 260KB
        • SHA256 bdd07f746b22d203ccae0e363be4783b821e2e205b468912bde46c9b928f0cc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SuspendFind.xlsx.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\SuspendFind.xlsx.WNCRY
        • Size 358KB
        • SHA256 399616a83e40b3a1e7d024c4fe7e60976cd19e20beb30fc38f0a9b279344a6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WaitOpen.ppsm.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\WaitOpen.ppsm.WNCRY
        • Size 744KB
        • SHA256 c749ffd7291670122ad3cef3f816200a2b6891c12c9f116f09f54a439940998c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteResolve.avi.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnpublishCopy\WriteResolve.avi.WNCRY
        • Size 246KB
        • SHA256 df71ba1629c3a3ebc72a643649a57bf1016eb7f7756937c36a67cf140e8c010a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertDeny.mp4.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnregisterJoin\ConvertDeny.mp4.WNCRY
        • Size 3.6MB
        • SHA256 1b6bd93d4ce54232537e212aaac8e29839bfddcffb8ea14e8f530ba313451f77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PingUnpublish.asf.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnregisterJoin\PingUnpublish.asf.WNCRY
        • Size 1.7MB
        • SHA256 b7ea4e6abb8f90f3f63ee124c64faec4f55f72814704f02a8870b56fd9f55885
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResolveApprove.js.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnregisterJoin\ResolveApprove.js.WNCRY
        • Size 1.9MB
        • SHA256 aa9291fadd2cd97f7581d1704229c3450d4499d89c5f36f9275af584b036097f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestoreConvertFrom.avi.WNCRY

        • Path C:\Users\Admin\AppData\Roaming\UnregisterJoin\RestoreConvertFrom.avi.WNCRY
        • Size 1.3MB
        • SHA256 fd6e2cf96f1b773ace3c38b3a3693244dc46a811fe461962c5555943c467788f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmRestore.docx.WNCRY

        • Path C:\Users\Admin\Desktop\ConfirmRestore.docx.WNCRY
        • Size 14KB
        • SHA256 a26e8af5db62f8b6ad96645af5f0e675242680e6dfab5949c222a0c8cf847c5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertFromOptimize.wmv.WNCRY

        • Path C:\Users\Admin\Desktop\ConvertFromOptimize.wmv.WNCRY
        • Size 489KB
        • SHA256 a63494d03337e47d8e8eceef13caf58a6fee9763ba6f3a91a4c67fb8f0c97411
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableExport.doc.WNCRY

        • Path C:\Users\Admin\Desktop\DisableExport.doc.WNCRY
        • Size 279KB
        • SHA256 3420c1119d3dd01f97422cbdbeec0637993faee04d28e9556a7b2db86142304a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableResize.pdf.WNCRY

        • Path C:\Users\Admin\Desktop\DisableResize.pdf.WNCRY
        • Size 419KB
        • SHA256 959900c899fec2fd1e677e20d92f7de9e413259d343da3d52a1c970023ec235c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeStep.docx.WNCRY

        • Path C:\Users\Admin\Desktop\InitializeStep.docx.WNCRY
        • Size 15KB
        • SHA256 c116f806035a61d1a57a9d9682edd2c43673e71a839fac146c04e2311961431b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InstallJoin.pptm.WNCRY

        • Path C:\Users\Admin\Desktop\InstallJoin.pptm.WNCRY
        • Size 628KB
        • SHA256 9632cc22b64d2cbf2f8a1fad1be182a83830d98a3c2bb75dd9b1b9b60575daad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InvokeUnlock.pps.WNCRY

        • Path C:\Users\Admin\Desktop\InvokeUnlock.pps.WNCRY
        • Size 535KB
        • SHA256 8397b44c814a602ceb83812b28ece04caaddc8fb1e82a4c2b1c9cc865e21620c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MoveTest.xlsx.WNCRY

        • Path C:\Users\Admin\Desktop\MoveTest.xlsx.WNCRY
        • Size 13KB
        • SHA256 6ccc21b41ff3bd77821bca65e40858f7c566c6e7e9d1e2ffbda64ae50ab12ef1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RemoveCompress.docx.WNCRY

        • Path C:\Users\Admin\Desktop\RemoveCompress.docx.WNCRY
        • Size 13KB
        • SHA256 ebe24187f538ad0f5f191edfaefe8150c7c2e4a6b65a8cd940625b89ca524f75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestResize.asf.WNCRY

        • Path C:\Users\Admin\Desktop\TestResize.asf.WNCRY
        • Size 512KB
        • SHA256 ac2dce360794b3fb758f87c0b4d6349fbd592b1c3b49709a7d9537f7898361cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoRestore.docx.WNCRY

        • Path C:\Users\Admin\Desktop\UndoRestore.docx.WNCRY
        • Size 18KB
        • SHA256 286e86f6055b5b7e01594527f8035b13b02167fa307c1681eeaf15a8e8c1fb7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnlockSelect.xltm.WNCRY

        • Path C:\Users\Admin\Desktop\UnlockSelect.xltm.WNCRY
        • Size 675KB
        • SHA256 ddaf20cec107bc3dacd8f8129c297029296ef152a68d9942040a734be8a3217a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UpdateStop.gif.WNCRY

        • Path C:\Users\Admin\Desktop\UpdateStop.gif.WNCRY
        • Size 349KB
        • SHA256 bcaa3c24e505da83b1fa6221fdb859660810f116c8156778b4d54709d6b8847d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UseUnpublish.cmd.WNCRY

        • Path C:\Users\Admin\Desktop\UseUnpublish.cmd.WNCRY
        • Size 651KB
        • SHA256 c1e3a3cc2cef6a88e3d5b3b652e310acae0819b524816dc920c26caa0122d284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AddReset.ppsx.WNCRY

        • Path C:\Users\Admin\Documents\AddReset.ppsx.WNCRY
        • Size 1020KB
        • SHA256 c08cd6eee67f16e737cf0bb5f17fba4ef03ad5057cf23f130bcd820bbeb3ca9a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BackupRepair.pdf.WNCRY

        • Path C:\Users\Admin\Documents\BackupRepair.pdf.WNCRY
        • Size 660KB
        • SHA256 c4380f13f2c1454f3090501c03555bc856a4497c12feab2dcfa9a655b88ddeb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditReset.xlsm.WNCRY

        • Path C:\Users\Admin\Documents\EditReset.xlsm.WNCRY
        • Size 1.2MB
        • SHA256 b3d829d389efaed38ac998e4f9140d91c5f847515f3ab3bdf91a01f400e706e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExitMount.xlsx.WNCRY

        • Path C:\Users\Admin\Documents\ExitMount.xlsx.WNCRY
        • Size 15KB
        • SHA256 f9c81e5d3834ff4080e2b101106247ac9e6c546921fa017b6e35321f16c30b13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExportReset.docm.WNCRY

        • Path C:\Users\Admin\Documents\ExportReset.docm.WNCRY
        • Size 600KB
        • SHA256 3cc2b5bc6ff3302819dc212f4962f1e2a03edea422b31519fda15af2baa469cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InstallClose.xlsx.WNCRY

        • Path C:\Users\Admin\Documents\InstallClose.xlsx.WNCRY
        • Size 12KB
        • SHA256 ba2bb5171db1161e65acb1ec099ac6b1f4e2a1e7bb835f889fe6f47037942f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinDeny.ppsm.WNCRY

        • Path C:\Users\Admin\Documents\JoinDeny.ppsm.WNCRY
        • Size 840KB
        • SHA256 573b4d3e70ebc6153affd4264822e3b3151dc8862db79b8a8fa6c7941373c488
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MergeConvertTo.xls.WNCRY

        • Path C:\Users\Admin\Documents\MergeConvertTo.xls.WNCRY
        • Size 540KB
        • SHA256 101f08ec4d257b68004dc55d12e9b7b4cc6f78ed7f336e24f0532288d989ebe4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Open Notebook.onetoc2.WNCRY

        • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.WNCRY
        • Size 6KB
        • SHA256 e2e143546c5f499b407e6c86832f3bb5b3b303c3bc237c703e5d2f8137535044
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Outlook Data File - eavofsldqw.pst.WNCRY

        • Path C:\Users\Admin\Documents\Outlook Files\Outlook Data File - eavofsldqw.pst.WNCRY
        • Size 265KB
        • SHA256 a0f8aeea04552baddba8e0b9d1663ee40959e260b1783ebad124472b899754b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResolveStart.docx.WNCRY

        • Path C:\Users\Admin\Documents\ResolveStart.docx.WNCRY
        • Size 13KB
        • SHA256 9873f6d5c3c266c168082e71ff3da80da7c6523e0bbe3b43b4b77e2eb85933ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestoreCompress.pptm.WNCRY

        • Path C:\Users\Admin\Documents\RestoreCompress.pptm.WNCRY
        • Size 900KB
        • SHA256 aa1d6a5ab286bde6b35ca02484c435fcfbe51cf3c4c304854db16a605ec34404
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendEnter.xltm.WNCRY

        • Path C:\Users\Admin\Documents\SendEnter.xltm.WNCRY
        • Size 960KB
        • SHA256 8a78ef573a59a9b60be4dd4e48a7789a4e0042e0303e9d85ad9c9abf89a014b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnlockLimit.docm.WNCRY

        • Path C:\Users\Admin\Documents\UnlockLimit.docm.WNCRY
        • Size 1.1MB
        • SHA256 5c22882ddd94ef54350b1f0aba496272d8a2c3bfcc89573c9f2236d816d02c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnprotectGet.docx.WNCRY

        • Path C:\Users\Admin\Documents\UnprotectGet.docx.WNCRY
        • Size 17KB
        • SHA256 d64f48a92c20194cdc2d814b807aba10b3ce96118dd029be275a2216f1211f83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UpdateRegister.doc.WNCRY

        • Path C:\Users\Admin\Documents\UpdateRegister.doc.WNCRY
        • Size 1.8MB
        • SHA256 582d820fe0769d2363d1b8655af76f614311b4fb2461410e5911e13878d18bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AddWait.rtf.WNCRYT

        • Path C:\Users\Admin\Downloads\AddWait.rtf.WNCRYT
        • Size 340KB
        • SHA256 117aac1369f4c194ddb3e0a69b8165ba7fee6dc50e28fbcbd73460ce48a6abdc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisableUninstall.vsdx.WNCRYT

        • Path C:\Users\Admin\Downloads\DisableUninstall.vsdx.WNCRYT
        • Size 404KB
        • SHA256 163dc021c65534fbc34dfccd9489a94497225926fa481b693c2316f56743722d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DisconnectLock.docx.WNCRYT

        • Path C:\Users\Admin\Downloads\DisconnectLock.docx.WNCRYT
        • Size 212KB
        • SHA256 0dbc9dd6dcbf9a243cb2ba5dc89726c03e2f1222f63e01afa62eb521558521b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BackupInstall.ps1.WNCRY

        • Path C:\Users\Admin\Music\BackupInstall.ps1.WNCRY
        • Size 339KB
        • SHA256 f457acbcc4bcd49324fafd16de8dc06e7b3659918caeda7d0e030a5d7e2730bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompleteGet.vsd.WNCRY

        • Path C:\Users\Admin\Music\CompleteGet.vsd.WNCRY
        • Size 897KB
        • SHA256 725c7183232d365571e05c6e06c429419e3423a14fc6a65f33e51d1677c1cd5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugExit.iso.WNCRY

        • Path C:\Users\Admin\Music\DebugExit.iso.WNCRY
        • Size 751KB
        • SHA256 1382e83fd316cc9d2c42a2e448e0ea92ae445dc4089e49b17e05db7ce56b53eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExitRestore.3g2.WNCRY

        • Path C:\Users\Admin\Music\ExitRestore.3g2.WNCRY
        • Size 630KB
        • SHA256 8b1ee2a3b1c906eaff97b3c8c39e1f7b7ebf031e5fd66409fd413a83ceeb60cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinReceive.tif.WNCRY

        • Path C:\Users\Admin\Music\JoinReceive.tif.WNCRY
        • Size 606KB
        • SHA256 3be623a6cf6c9e8d3fb54e3983b11070400a1e7db80071df1d3d73eca77166e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MountWrite.xlsb.WNCRY

        • Path C:\Users\Admin\Music\MountWrite.xlsb.WNCRY
        • Size 557KB
        • SHA256 6be802d49afd764bbba116d1896969cdf48ac5bcc53bda337856e53e29abb211
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnregisterAdd.pptx.WNCRY

        • Path C:\Users\Admin\Music\UnregisterAdd.pptx.WNCRY
        • Size 460KB
        • SHA256 553fee8ee9c2107fad334cee1233ad7e98494556022f5b28625302bfaf57cf29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertUse.bmp.WNCRY

        • Path C:\Users\Admin\Pictures\AssertUse.bmp.WNCRY
        • Size 402KB
        • SHA256 7e965b8df9d259ef4e85b1ecc43ebdbb1e785722e5a714ffe2eb9014c9d8e596
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertFromAssert.tif.WNCRY

        • Path C:\Users\Admin\Pictures\ConvertFromAssert.tif.WNCRY
        • Size 439KB
        • SHA256 7b4fb2acfe1dd59410675bb7b9ec7d7436b07c0e3c032fbdccd3882f44b9cc31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DebugRegister.jpeg.WNCRY

        • Path C:\Users\Admin\Pictures\DebugRegister.jpeg.WNCRY
        • Size 695KB
        • SHA256 75903d64159a7f03ec717780d3db420975a69c2ea454fdd12f9ab19475b0de84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InitializeUnpublish.svg.WNCRY

        • Path C:\Users\Admin\Pictures\InitializeUnpublish.svg.WNCRY
        • Size 676KB
        • SHA256 4c9d3ceb10722873dc89fcc73617d439fc43c552eacaa7eda8d75eebda33c720
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InstallRename.raw.WNCRY

        • Path C:\Users\Admin\Pictures\InstallRename.raw.WNCRY
        • Size 512KB
        • SHA256 72dd4fe363b5dd525e88d2b36b0875ae0c3b0c46789eeb58a19243c9db28680e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockMount.tiff.WNCRY

        • Path C:\Users\Admin\Pictures\LockMount.tiff.WNCRY
        • Size 530KB
        • SHA256 e4bd0b82edc6c88d4112ec731962f12bcddf747ba2b8b4514a87f8ceec918704
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockSuspend.raw.WNCRY

        • Path C:\Users\Admin\Pictures\LockSuspend.raw.WNCRY
        • Size 347KB
        • SHA256 8034d6c99dec2e67001ceebfad289a8265b9f377901a9e840d1cb22f3b7f4677
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OpenDisconnect.gif.WNCRY

        • Path C:\Users\Admin\Pictures\OpenDisconnect.gif.WNCRY
        • Size 622KB
        • SHA256 a1e88d2ecfe2a0177a254b9f21888d1ea3a3c0414d7fa3e9214f9551d65cd65e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RenameSync.jpg.WNCRY

        • Path C:\Users\Admin\Pictures\RenameSync.jpg.WNCRY
        • Size 713KB
        • SHA256 39f48b60165457e920db454a2f91b761396583c2d1b2daa933ff1e664d590b95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestoreDeny.png.WNCRY

        • Path C:\Users\Admin\Pictures\RestoreDeny.png.WNCRY
        • Size 256KB
        • SHA256 3a7fb5335b38f5027e246a4602dedafcbdd0ddf69393be8e87a4ad029c045d53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TestUnpublish.dwg.WNCRY

        • Path C:\Users\Admin\Pictures\TestUnpublish.dwg.WNCRY
        • Size 658KB
        • SHA256 7052b40907fcd9ffae63c62a48890dee6dba79bc182401d2649c3b3e25b98864
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnpublishBackup.png.WNCRY

        • Path C:\Users\Admin\Pictures\UnpublishBackup.png.WNCRY
        • Size 366KB
        • SHA256 a0778c7c30ff1adca40e48a22353f5b02e451becc4398b3bf05ab8e474815989
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnregisterStart.gif.WNCRY

        • Path C:\Users\Admin\Pictures\UnregisterStart.gif.WNCRY
        • Size 384KB
        • SHA256 af3579505c235011f05eafcd368b17dc886e771052d345f32fca37765279e3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uOHbzTXlr.jpg.WNCRY

        • Path C:\Users\Admin\Pictures\uOHbzTXlr.jpg.WNCRY
        • Size 25KB
        • SHA256 30d8984d2868aa72fc4be28da33a523cc4aba4853dd2df39f2869c5de23f5f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1236-39-0x0000000010000000-0x0000000010010000-memory.dmp

        memory/4008-2674-0x0000000073F80000-0x0000000073FF7000-memory.dmp

        memory/4008-2666-0x0000000074000000-0x0000000074022000-memory.dmp

        memory/4008-2668-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/4008-2670-0x00000000742E0000-0x00000000742FC000-memory.dmp

        memory/4008-2671-0x00000000740C0000-0x00000000742DC000-memory.dmp

        memory/4008-2672-0x0000000074030000-0x00000000740B2000-memory.dmp

        memory/4008-2673-0x0000000074000000-0x0000000074022000-memory.dmp

        memory/4008-2669-0x0000000074300000-0x0000000074382000-memory.dmp

        memory/4008-2663-0x0000000074300000-0x0000000074382000-memory.dmp

        memory/4008-2664-0x00000000740C0000-0x00000000742DC000-memory.dmp

        memory/4008-2665-0x0000000074030000-0x00000000740B2000-memory.dmp

        memory/4008-2667-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/7028-2636-0x0000000073F80000-0x000000007419C000-memory.dmp

        memory/7028-2659-0x0000000074250000-0x00000000742D2000-memory.dmp

        memory/7028-2658-0x00000000742E0000-0x00000000742FC000-memory.dmp

        memory/7028-2657-0x0000000074300000-0x0000000074382000-memory.dmp

        memory/7028-2660-0x0000000074220000-0x0000000074242000-memory.dmp

        memory/7028-2661-0x00000000741A0000-0x0000000074217000-memory.dmp

        memory/7028-2662-0x0000000073F80000-0x000000007419C000-memory.dmp

        memory/7028-2656-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/7028-2648-0x0000000073F80000-0x000000007419C000-memory.dmp

        memory/7028-2642-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/7028-2631-0x0000000074300000-0x0000000074382000-memory.dmp

        memory/7028-2632-0x00000000742E0000-0x00000000742FC000-memory.dmp

        memory/7028-2633-0x0000000074250000-0x00000000742D2000-memory.dmp

        memory/7028-2634-0x0000000074220000-0x0000000074242000-memory.dmp

        memory/7028-2635-0x00000000741A0000-0x0000000074217000-memory.dmp

        memory/7028-2626-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/7028-2630-0x0000000000BA0000-0x0000000000E9E000-memory.dmp

        memory/7028-2622-0x0000000074300000-0x0000000074382000-memory.dmp

        memory/7028-2623-0x0000000073F80000-0x000000007419C000-memory.dmp

        memory/7028-2624-0x0000000074250000-0x00000000742D2000-memory.dmp

        memory/7028-2625-0x0000000074220000-0x0000000074242000-memory.dmp