be0df317ed8108369eca9d175ca879cdf7cdb4d54fb2e6f2a0771cd13cba9d7d

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GMCRY.exe
Size 64KB
Sample260808-3sraqsfh37
SHA256 be0df317ed8108369eca9d175ca879cdf7cdb4d54fb2e6f2a0771cd13cba9d7d
MD5 a1c9aec6682ebc695e4dc89ea5a2ee68
SHA1 0fd50f778b8a7270a1b35fce65e6859e69c626d3
SHA512 50a27934dc9916b5e26e7ccb9b3d5d2c00c7ed76c676403b4ee5857aff3be164a4d43232e59c2efbf0d343ead26281a08d617fd36209f2622d04f87a9a80ff91
SSDEEP 1536:rvZgmjVk4leE2nWsb/8YZTv/ozY3bliTjVR:rvWyVk4leESWsb/8Iv/TbliTj7
TLSH
T15153F80577F88A05F1BE5B79CEB281044776B9929936D70E0DDA64CE0523F208DE2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Ransom Note

============================================ YOUR FILES ARE ENCRYPTED ============================================ All your files have been encrypted with military-grade AES-256 encryption. To decrypt your files, you need the GMCRYDecryptor.exe which should be on your desktop. Run it and enter the decryption key. Contact us to get the decryption key: Telegram: @lol123yy Discord: zxc_009 DO NOT: - Restart your computer - Delete any .gmcry files - Try to rename or move files If you do not decrypt within 24 hours, your files may be lost. ============================================

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	GMCRYDecryptor.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	GMCRY.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	GMCRYDecryptor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	GMCRYDecryptor.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "cmd.exe"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	GMCRYDecryptor.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	GMCRY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	GMCRYDecryptor.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk	cscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.vbs	GMCRY.exe

Executes dropped EXE 1 IoCs

pid	Process
6052	GMCRYDecryptor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	GMCRYDecryptor.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
2628	cscript.exe
1560	cscript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gmcry_wallpaper.bmp"	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\Wallpaper	GMCRYDecryptor.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	GMCRY.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
636	cmd.exe
2644	cmd.exe
1352	cmd.exe
4192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GMCRYDecryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GMCRY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1860	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\AddToPlaylistVLC\command	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\AddToPlaylistVLC	GMCRYDecryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	GMCRY.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4896	schtasks.exe
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6052	GMCRYDecryptor.exe
6052	GMCRYDecryptor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	GMCRY.exe
Token: SeDebugPrivilege	6052	GMCRYDecryptor.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
1368	msedge.exe
2032	GMCRY.exe
2032	GMCRY.exe
1368	msedge.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
1368	msedge.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
2032	GMCRY.exe
6052	GMCRYDecryptor.exe
2032	GMCRY.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2628	2032	GMCRY.exe	89
PID 2032 wrote to memory of 1560	2032	GMCRY.exe	93
PID 2032 wrote to memory of 636	2032	GMCRY.exe	95
PID 2032 wrote to memory of 2644	2032	GMCRY.exe	96
PID 2032 wrote to memory of 1352	2032	GMCRY.exe	99
PID 636 wrote to memory of 4896	636	cmd.exe	101
PID 1352 wrote to memory of 2860	1352	cmd.exe	102
PID 2644 wrote to memory of 4932	2644	cmd.exe	104
PID 636 wrote to memory of 456	636	cmd.exe	105
PID 1352 wrote to memory of 4988	1352	cmd.exe	106
PID 2644 wrote to memory of 2564	2644	cmd.exe	107
PID 1352 wrote to memory of 1136	1352	cmd.exe	108
PID 2644 wrote to memory of 2448	2644	cmd.exe	109
PID 2644 wrote to memory of 1728	2644	cmd.exe	110
PID 2032 wrote to memory of 1368	2032	GMCRY.exe	118
PID 1368 wrote to memory of 1316	1368	msedge.exe	119
PID 1368 wrote to memory of 876	1368	msedge.exe	120
PID 1368 wrote to memory of 2664	1368	msedge.exe	121
PID 1368 wrote to memory of 2664	1368	msedge.exe	121
PID 1368 wrote to memory of 2664	1368	msedge.exe	121
PID 1368 wrote to memory of 4440	1368	msedge.exe	122
PID 1368 wrote to memory of 4440	1368	msedge.exe	122
PID 1368 wrote to memory of 4884	1368	msedge.exe	123
PID 1368 wrote to memory of 4884	1368	msedge.exe	123
PID 1368 wrote to memory of 4420	1368	msedge.exe	124
PID 1368 wrote to memory of 4884	1368	msedge.exe	123
PID 1368 wrote to memory of 4420	1368	msedge.exe	124
PID 1368 wrote to memory of 4420	1368	msedge.exe	124
PID 1368 wrote to memory of 4728	1368	msedge.exe	125
PID 1368 wrote to memory of 4728	1368	msedge.exe	125
PID 1368 wrote to memory of 4728	1368	msedge.exe	125
PID 1368 wrote to memory of 4720	1368	msedge.exe	126
PID 1368 wrote to memory of 4720	1368	msedge.exe	126
PID 1368 wrote to memory of 4720	1368	msedge.exe	126
PID 1368 wrote to memory of 3424	1368	msedge.exe	128
PID 1368 wrote to memory of 3424	1368	msedge.exe	128
PID 1368 wrote to memory of 1732	1368	msedge.exe	130
PID 1368 wrote to memory of 1732	1368	msedge.exe	130
PID 1368 wrote to memory of 3344	1368	msedge.exe	131
PID 1368 wrote to memory of 3344	1368	msedge.exe	131
PID 1368 wrote to memory of 3344	1368	msedge.exe	131
PID 1368 wrote to memory of 2468	1368	msedge.exe	135
PID 1368 wrote to memory of 2468	1368	msedge.exe	135
PID 1368 wrote to memory of 3852	1368	msedge.exe	134
PID 1368 wrote to memory of 3852	1368	msedge.exe	134
PID 6052 wrote to memory of 4156	6052	GMCRYDecryptor.exe	143
PID 6052 wrote to memory of 648	6052	GMCRYDecryptor.exe	145
PID 6052 wrote to memory of 4192	6052	GMCRYDecryptor.exe	147
PID 4192 wrote to memory of 1860	4192	cmd.exe	149

C:\Users\Admin\AppData\Local\Temp\GMCRY.exe
"C:\Users\Admin\AppData\Local\Temp\GMCRY.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2628
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:1560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_task.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "GMCRY" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "GMCRYUpdate" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" /sc onidle /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gmcry_install.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:4932
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_block.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Disables cmd.exe use via registry modification
    - System Location Discovery: System Language Discovery
    PID:4988
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - System Location Discovery: System Language Discovery
    PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ff90d47c188,0x7ff90d47c194,0x7ff90d47c1a0
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,392172091531979117,6706334073758574623,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,2939360313739099643,7692226214523909134,262144 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:2664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,12012642314538477963,11973734665496352376,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,17681861369504924431,3903657188106017694,2097152 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,17364249909582323992,11419559575204019165,2097152 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,8764886800623633039,11060641665193129157,2097152 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,16090074417944442899,11009386435095757848,2097152 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,6253197615613789364,10409342240859019733,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,10124228444172853180,2280301479366072768,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5448,i,11336411488424996052,567892865016133797,2097152 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:3344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,1920783545620525091,9097285034405471555,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
    3⤵
    PID:3852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14848369616321688481,10225174844453721762,524288 --field-trial-handle=2224,i,2646109440267914226,8620981089634226210,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
    3⤵
    PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4040

C:\Users\Admin\Desktop\GMCRYDecryptor.exe
"C:\Users\Admin\Desktop\GMCRYDecryptor.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "GMCRY" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4156
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "GMCRYUpdate" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_selfdel.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

GMCRY.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk
Size 868B
SHA256 6a3e65abdce43ead2817fd1ab0420ccdbe6bff03b2ec345745e443161d61cbea
MD5 19c3371720a903054564f844647df1cb
SHA1 fda50ec825cf3bd036bf382a3d9b466b2649516e
SHA512 8a610b0a9a0d1df432128715854b7eb12c2a7497a540e434c219721207a8d2c24f5916dd465b9747c04f57735a34f51466f16e31b7675ee368cd617927a72d11
TLSH
T16C1156554DA52732E7F28A7443E65321C6355C51FFD61F064042C1492469D14FD75F3B
MD5 SHA1 SHA512 TLSH

Submit Download

360f5c38-4424-4477-838e-83fd6c665f0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\360f5c38-4424-4477-838e-83fd6c665f0d.tmp
Size 8KB
SHA256 3b3150a3811a886125559736559788dc03eb4d526a744eb43165a4b28c1701f1
MD5 d0d27cfd50e7cf1d48fb9466a46a8a2f
SHA1 a4d03b8b203b94c4f6bcb01ab0daa6505bdc794e
SHA512 4c5b64deefa06ae3297a788bd68602add2df120bf0aefb6df2103b5e358e3181eb3646406002b2e39d8c427da9fdf55b828bf699501d6d459f96bd9fcf039a44
SSDEEP 192:tONb6JkRtQmiUytbW+RNKFCk5dZDh3HREU6:tONb6UrWW+RNT6bVqU6
TLSH
T1F502FA35AC386C7B9EF36D05B48737275FA4117BAA952F40DAE81E1C00D765C234693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4fd9c1c3e89a25e7f1347184af56f22628aede47142c5a851e3416974730905
MD5 17e372cd0fe11772a6f6d1a76a1bbadc
SHA1 775b2c8f1bfc3d3e54da381f6a89e54b25621783
SHA512 61ab148ec5c114fd2c2f150054e94ef4ea6f3a5026c6b0ad49bd443389eaca58ad9626911fa51b9a9bcb6cbcdd0bb9e0a502264ade947371b4a6e81d703fa40f
TLSH
T12BD08010752976D3E217007E44605B01591585776273B3057121580DDE74085F58B5D2
MD5 SHA1 SHA512 TLSH

Submit Download

93c5ec15-d9c6-434f-a2a2-42a12c72bfb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93c5ec15-d9c6-434f-a2a2-42a12c72bfb8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5854fb72c92508ed1d2938869643ce634440e225d604f6e651a47c866a7ce1cf
MD5 557b7bdc9de060235ffe7cb2b6a862c0
SHA1 4547c9f9e3425b50ee3124637abeb4a62994dafb
SHA512 7badfeb1d1404fab0eb381f118b0cf85f04fada43a993d450192ab4cc57f6d84d3fb6e30d48b73184dfb77330211cea06be1f33ff324ac195e53b652921a8595
TLSH
T19471503E1A2608A1D7B1883278CD12947DB5C9DEFE336DAE017AFD70E50D31A412B0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b0ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b0ad.TMP
Size 3KB
SHA256 be887867987bc2b56f2463e8bbb23f8eb4bdfd1aec367a9b561e3d6e4e7b2d59
MD5 770fb36caf92dcaabdc028820be750f0
SHA1 cbd3c5e4cfa323031fbdd34442f13a318d47d9e3
SHA512 2551f94a3fb9a6a084560fdddc42417b4484621461e54a1c855ef51c235db4fc0f5808f8d1835709b2dd28cc7134c9baa367ab6292dbe6ad292c5fb2f06ac257
TLSH
T19071523D192609A1D3A1883278CD12847DB1C9EEFE335DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 59de7b415fd738cc43625869d25297237b7ec3488a9f17a50eb0808d39215f1f
MD5 e2b54348a41a76aacf90a0a0784816a1
SHA1 852fc2279f6b0befa25db317931d0cab76e50197
SHA512 4e51fa664509d5987a3820cb666f67777b18361833f79326d7ec29b8d3bd10c6501f282323d36037006533bfc05a6e261d1d9e3b67c99e36c03589ed455f8ad4
TLSH
T1024168F7C3E8857D890156F8AB15AF1BCE1D0A15432C3D26C5D4AE2BD3E2871E24199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 192d94e378353855f043a1e02be5ce43d610c4005b6a21ad5db151b35be4d9f0
MD5 1048d58f820bf7562f65f7c6e1bc70f8
SHA1 b4ef8781b177b886f20f64df47ecc203754fc1f1
SHA512 1c69a74a1a669f066277ab3e07cbf7e5a9c2ff3e27686fba24e9bbc915f15e0b37a67b823bc16d7fb8afc5583c544aed4a4e9133859e7a3ef5b299402af6a5ea
SSDEEP 192:sxZzRYjs/ffsOAWpVaLsEdpqQgHW6+WN72z4/YAN6XIgEJ:sxZz6s/ffsOAWvaLTkHb1/iI
TLSH
T1E732B8126E38A83B8CD7D21DFB25BF13E2F91022A5D51E58A7FC951C05E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9791ec9ede68c3161b80ea01144edec08e1263a3902a12499b7c1b11d58137e4
MD5 f35acef427b2f917ec204ecc25639010
SHA1 900a7032aa2859a8fee007ff73f39f54500e8c82
SHA512 7624a926eb9613b32c832e8e3180ef02fd32682a3328fd65ddd2f8503a7bc2c5145e70c6e5a75bee39429b45e11525f1e84fa8ac1929735f05d09ab5a30055d8
SSDEEP 768:98yqbUlWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVj4Ll6AR7uroL1A:98yqbUlWvJDjTu1jaE4LAs7lLm
TLSH
T154C2F93B654CCB7E4F800AADDD1A6FD73ED801C7A6588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 1beca36121fd8eb92d37297f079efb175ff1dccdbe062976166156ee4cc0889c
MD5 5755f27bf312b64764bac011b81fbecb
SHA1 3d181399e7bd5e16e13284e4d0752a3674386b36
SHA512 541ccb1d78c1b0a413335626a9643d543d2f54fe5a797d5799b45b3f018b6e54be18e04774e3bf97552fbd705084e695e32b83214c98b3c4094fef8f6abbe2fe
TLSH
T1E0B0220C23C22F00FC0283F802CB80003A300C30F802E30330E2B0C388A2C008E2B00E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 46fdc26e669c891ab552048bde45f9f94e7be32bb5fe31bf880f54da0051df89
MD5 44c579a64d9d26dbef96b4d696e5023a
SHA1 ad09ea7b37fce3443bbdd838656a3b1a977e9376
SHA512 ce3c005e9c7ed272185bdcb03ca6a667dd0194ce7dbf436b99178d3a5d5912b78330de9cef58d00e1de44e0a637b9730f5919e861c0802206779af3e150b6800
SSDEEP 384:z+sN2trClbnCUVRNT6b4/xAStiI7kB5EqKXKX:a28qHTzGSIB5EqKXKX
TLSH
T1E5722A71EC645CFB88A1E4C2A547F2132EB4417BC68D2E5C96F87A3C309F9F8135652A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c22dda935e31656cb14bf3983de4b86ec4dcd9a41e517caa281ef6e9ca1323a
MD5 5cbda82eb4819ae6589ddb4f00c0e415
SHA1 dd31eb99b35b59a4988c444a71424acc86836db3
SHA512 5554238c6886d3aa17afe3c58ef7f2bbd9c9b230279762210b5005d4595f03994a89a5f41b5738429f8a9054d11c741ba2cd95a67692a3daf0af5db4e2fcc3b3
SSDEEP 192:7ONP6JkRXQmiUy2bz+RNKFCk5dZc0vtVcoqHlU6:7ONP6U5/z+RNT6bsfU6
TLSH
T1E9120A35A8389C7B9DE6B805F4C733535EA421BBED856F50E5D81A1C00D7A9C2B0E93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e1c07841-23ba-4268-a13c-fda433a65099.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e1c07841-23ba-4268-a13c-fda433a65099.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 145a180c3250b29d353f47158c9609e4a0e55840fcd81648298cbc300ccc00ef
MD5 b86678db4c2f99487ef17e07764a8f08
SHA1 ffa138bb8223fbbfc1c1ea4941e4fa19b00e77f1
SHA512 ccb2aa0c3c9f8d54615e1701bd4134995bf94b5ad88068466b3615c84ae881bded9350acd04a5a8d21a652b1745b4b7a5a476fda51a5e4c82b4867c44728391c
TLSH
T166410959B6E91108B3B33E5AABF6685E48BFBC772F07919D10110E4E0A22B40C8A1777
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_block.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_block.bat
Size 368B
SHA256 8cdef703e4a3c9928b65aa830ba19ec6cc86e1d6bd3a0d14e29785d5ee14fb47
MD5 a0f868513a7ea2d28dc55726fa7c3f22
SHA1 43e9b041cf17c90f8b69b6c591ac4ed1ffce9aba
SHA512 b9996848f9bfcc2c1ae46fe8b683812eac080248b4f8b08bc3c8eb89e121cf6df0c44ed14b1302f019ea249a4fb010372d807121c7734a91bbf2bbf2070f3b80
TLSH
T129E04F30740496B3E6A1B624988F5812ABBBE7CB7810EB95699A2046483B189C23C9D7
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_install.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_install.bat
Size 584B
SHA256 9f121c1ca8b03dee8ed56b4f20ded1e2b63f5f3c9830e498924e7e83d31dc5f0
MD5 186a7b6ba541c5b23d3d20f775b37c82
SHA1 fa144d8e97f80d8c3d8b40e1d3bab6779e5d3210
SHA512 a1e4faf06b0fcf963b80a876f1e326f640ef19db0356a0e20dadbac0943033bb7f9d27e01d91c9c16061c5c4e04299909cfc0e8d5bdcf82d090d8b2f96efca1f
TLSH
T139F02B01BA184721D2D56820E48BDC3736B723DBC044ABF62645D048402E26DCDFF3E7
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_selfdel.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_selfdel.bat
Size 122B
SHA256 f33faeb2773d527db5107697803e5d3d1dae14e2755d9888ed8121ac37a47c85
MD5 bcb271a0c9a8c648000b5938ee90df09
SHA1 8ae98300897cbb39eabf0377d2e88f0da0794c6b
SHA512 977c5c6cdae231f23de080e5ae27fd1631da3dbc0e5a39a9e61644b8a6d4b596cceab811c0b5fe5632e855c99faecb2e3830e4c6aa253e6071df81c655f42ba6
TLSH
T18AB0921F30894A85028110E686BE609E52DE18D38C48F2C343C291ABEA8B039969BEC9
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_shortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs
Size 271B
SHA256 8c9b97436249e8d350de770f522f3318546feae87d2e31f402c9557ed9a50aeb
MD5 716466bb86dc64baf8f36d513039ae68
SHA1 49189c150dfdec20cdd53a6f494b51a6e7f79f02
SHA512 b95bc4b71745bd1bef45b636d4160b70c57f80b6896d81ad6a794fbc341787da5607ca81e2486aabb5eaeaaf06aae54364d4ee6554e5795af68e701c426e5492
TLSH
T116D095957158C29FC003327302F3CE0DC5E1C1A53B07EE758A15CD8D7641444C9B6083
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_shortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs
Size 255B
SHA256 e5b61331b7686d63d4b2482ef2c1eabea66c946b605f4b698c859e6e2b6c8562
MD5 f46294ee45b67dfd5e394da4c4f84cb9
SHA1 063c6c2bdf7752ea4c1c0067967658f12a0a48ec
SHA512 e762a1d33ee128fb100f6308a538adb8782ce124164986322856bff6bfc1ee95e17cd280d32c9db3f349dcdc3c2bd80f1f8d77f86d72cd172b8962ba831fbc78
TLSH
T190D09795B118C2DA800332A202B3CE0ECAD1C0AA3707DE768959CE4EB601944C9BA083
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_task.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_task.bat
Size 220B
SHA256 258a7ff81b04ef5dd9b7c14c07105f6b90f1269a58dd03ddc44bd14bd020f887
MD5 446c8953004714d47ed75b7cbdf49042
SHA1 0911633420d4bb9658c2390c129426ca7fdbb060
SHA512 c10c72f29058cb1fa00c186fc3f10997a17b794ec453a08f9acff898943fac911ca59c94583ec9c6832edbe4c1953ad83d9cf8aac25e13b0686b6e36f14733d1
TLSH
T1E0D0C95F1986CB48280384A70BBB1057AEB549977A552A8C8A8E44FC918D41DFCAF701
MD5 SHA1 SHA512 TLSH

Submit Download

GMCRY.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk
Size 806B
SHA256 0a17b2b5a9965c90debf833b2449ccff53ab1bd487a19652a77acae86fcb7ad3
MD5 a11fb38c92a9a8a2571549f217033f54
SHA1 78947623907f8eb0cde1b368cdfd84e7365c29a3
SHA512 79d92ee7619b33fbc9d91c39d8f7197cb6afd52425594782e1b7cf9dd861d1065e2662851577d65382a5f36af552f6b81b3b6320f7b92bcf10237ec90cdaa734
TLSH
T15D019E544D961B32D6F1CAB042E66322CA252C81FFE60F064042820A3469E14FCA8F2F
MD5 SHA1 SHA512 TLSH

Submit Download

GMCRY.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.vbs
Size 115B
SHA256 9ed9165c925eab3497b86141896be15ea1e32f7605d7f908edde47b89a657208
MD5 c0307f4ea69a7c1e64857c90dd187127
SHA1 84d03d1cdb0e3be48c12c3b0eb88b5720ba0abcb
SHA512 d06a7d9bc8b9e5ea7c4d59ac8adea05b5cabe8f9744e6d1fefa19eb3c8d93fb146f1b08d9f4486cb7b403cf639356f0883883b8799cc2193a84e26a1fcc1a0c9
TLSH
T160B01205DC9CC51D640AC1F30BB1910E8BF5966165166C588B10C49C7348458AB27223
MD5 SHA1 SHA512 TLSH

Submit Download

BlockMerge.gmcry

Path C:\Users\Admin\Desktop\BlockMerge.gmcry
Size 341KB
SHA256 3ece0b49fe757bdbd2e76a82b3ed152178056121053f8073e9cbf0d0eb20f105
MD5 0bbd02e3521d75972cd5acff8e669d6c
SHA1 76cf51dca42c8e74f36230c9b17def7317b9b289
SHA512 da94d6fdf37d57f3defcce35ee39668ed4373f6124ddb335e49b1d5af9f601cc1bbfda09b75879eca279a41f1288cdaef24a87ce85ef71c3e85ccf4304b2fca1
SSDEEP 6144:PmoGWtnXnAMpZhfV3QtRI6iUzZEExfuRDLUswLJdCQ0N1dDA0kAGtnMIzNl/h:PLGWVXBpZttwC6HzZyshLJ90JA+GZ5NP
TLSH
T1307423BDF7C31E0619825CC3E101D067655D0EE1FD3A1AA6A06FB493528AD32FB74A71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmBackup.gmcry

Path C:\Users\Admin\Desktop\ConfirmBackup.gmcry
Size 327KB
SHA256 30f79989eb659c7ca3bf66b5667e4c96c463d2f60576ea9b9cfd9404ec6b1b3a
MD5 86d666be420d9209da6e349df533abec
SHA1 03600ecdd63aeb732c2a14af1deae645810af5d8
SHA512 3cf8a0eed557dfda2dfea7fdabd239f2afa302e322fffac555d27ca4badd61572b19bdff35487cb63c939264a08a7e6b3f014efa4ee1b8bb26952a6ad10bb5ee
SSDEEP 6144:Fhxz+GuspZu9B36ykV0mPYps5YjV2fuFVy+VqwryD2MSi29eScMaA:rxz+G5Huf3gPIssweVySqwr0l2aMp
TLSH
T1A76423DDD8E551BA4258DA4334CDA207B79EA94EF386C5F09C923F437A6F02700A2663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertToBlock.gmcry

Path C:\Users\Admin\Desktop\ConvertToBlock.gmcry
Size 10KB
SHA256 0888e5a2642e8957f3208df39d228c3a118dfa4f853f708d47d16169643f1050
MD5 4b78001e6b14f4876e57d280c7133341
SHA1 954fd1ae8c9a93722494a32a16a11809571ecbb6
SHA512 bdac9b284855689810d33966f1303015628ed08a915dddf0b103f1981b853c042d0299111855fc1bbd4651643fefd99f5d187925de3131e5149af72f72099540
SSDEEP 192:lkENjAh+fUG7brX1SmsRLt4cJYxf64fF/sSHAyGUk1A7s8w//IZ:FNhFPrX1SjLmcJYxfaoMZloZ
TLSH
T13622BFC8BD8E38C543EA7DF17E6AC0BB6460469E6780AD068D4A967073EE7720604D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterDebug.gmcry

Path C:\Users\Admin\Desktop\EnterDebug.gmcry
Size 469KB
SHA256 13aa381c1b26655108972a539b326e25cffd46873fc9f9f27605643d0839e4ff
MD5 7c5091329db506c48716d8d276fbfc98
SHA1 8a00806b84cb1bcb3a898f63ec0179eb624fc754
SHA512 f96bfd469be52b8162ebefdbffee3eb569e1da4139cb3917a625a3f53d26e7d86588c0af44bab417ba7592bcc7f46a4cba2fc6097ec074b47d57a973b414e32c
SSDEEP 12288:blqb1Y7AXP4MU2zI85msazzdurZBHt7kI+cQ9G:blquE/G2zIZzpurZBHt7eG
TLSH
T190A42344B5C4C725B6148FF9D79FEE63ABCD7B986B28C76FF260013A12330106564ACA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMCRYDecryptor.exe

Path C:\Users\Admin\Desktop\GMCRYDecryptor.exe
Size 14KB
SHA256 6fae846268980b6b91cc6d4a01573816b75dfe4210e8ab213ce157727b2d946d
MD5 ed651caec8d6da13c46d5fe10b84eecd
SHA1 f7244455493743b5e0bc6d53737d5f74725364c0
SHA512 29dd7ab4254b397d9d5ae4f3861d8e1e42946c066e25613f84a0bf6ea6a8a6a1a5653c76393d353b150a04c05d1f98578a062855feded2b5596b045916dfc438
SSDEEP 192:TfPpOSacc3DnoXIjzBu4ba6R9LBJjamAcqsa/9VAFC30euAXWg:TAiXIjzbf9LG/RVgWYAXWg
TLSH
T14362A704ABFCCA05F9BF4ABA8E7382008B31F886D971C75F0645448D1973B558EE5BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GetExport.gmcry

Path C:\Users\Admin\Desktop\GetExport.gmcry
Size 369KB
SHA256 dc89cc45c162b4a83d41010a0d959edea4aefa625875f56f820f3042a4e2a52a
MD5 58588a0b79cb74ecc48b44b9938c1b8a
SHA1 eae1c45203e729ea4e1a477163325076c3fde69e
SHA512 8d1e3988c94809a59cdbd6195f3b99aa3768f2c7922eda00862625231ddd99805a948facb759340f3a8b84c2b6979fb2369619bc9b2a761ba51ef48f2797d2d1
SSDEEP 6144:sSit8AwQeNu1BMgQvAf0EcWUfxbdvmeCbje47v0Ib4Yqtoa9QLhMqBp6heuz8vRo:dit8DQeNEM3ofZcWEHvfOS4hatoXLhMv
TLSH
T11D8423D5601D6BFBCF42D1D8B509C0AA401F90A826DD90F0A323ED5AB3D79C3965D6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockResume.gmcry

Path C:\Users\Admin\Desktop\LockResume.gmcry
Size 13KB
SHA256 b777b09f335bb151454927db711e809929bb1352885b462aefb9f9258f16d25f
MD5 f0e88914b251e36b47f9c1714b34301c
SHA1 030bf70b0b34ba5624a78fa305689c968933fc72
SHA512 eef60a4e16f422e02a00780db22b6053f8bd9690e12e8d9daba163765aa7d7313e24f1bcfef6f8cb2579fa9c7ec3f666f7bd8ae7e762ed95bea1bd19c95937cd
SSDEEP 384:SAZApzSd4jy5rXZEEGzEWxIqM7zrjaTh+uE:SA14Wh0zsbrOAuE
TLSH
T1AC52D00CB3CACF74FDEFFEA24588E4C77D81E885991AAE66109B0AF51142890D578D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OptimizeResize.gmcry

Path C:\Users\Admin\Desktop\OptimizeResize.gmcry
Size 184KB
SHA256 5decf2a85d0c69133c1d8c8b2d16a81dfd323dc6412ab0539148b617c0bda65b
MD5 74fe1aad8dfebca85e5b18617b5cfaee
SHA1 930e3c19a6bb785bd61363e90abc81e9099b0c94
SHA512 13331e8dee85a906324a413c8f7f0d6de20791fbee151c8892f9f4624e782a8adb263d9ca5e4d2bb0015629b501cac6a22c5cff8abed221870efce539ddf21d7
SSDEEP 3072:0pOz5BoX/Q9uxIGoJJ64p0WwcrrHlvkBJ1ieecyXx1n5YL6cLp:0SXovEMIGoc4mWLrRZcyev1
TLSH
T1680422BB645B9A72246A9F5B25C8C4C21079345C791DB72C9E3CA2D690FBFF400F394A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Users\Admin\Desktop\README.txt
Size 611B
SHA256 bea16716f1a0f8b5339b6a94e4bbeeb1040d09b4d543dbd496b0fb9b0c047263
MD5 ca988c73d13bb5628ad68fa6894dad8d
SHA1 12fd7eec33a888a805d761876284303d064e408d
SHA512 7889c8aaa690f29e4a2628a1af3a37f425b5c2318129bfa4dd28b9b528b16d1a4d842b6a7dd09da31bc937aae1453c1bab843c935fad73e22d03814277716e0c
TLSH
T195F09E3FBF6D552162C141A37772F9A2AE1BC10C244DA650A8EE908873FD3259282874
MD5 SHA1 SHA512 TLSH

Submit Download

ReadMount.gmcry

Path C:\Users\Admin\Desktop\ReadMount.gmcry
Size 455KB
SHA256 e4a268799bc6383be2dc8af45a4bdb5d56207aaee59a3c515b0d57c2cce3645a
MD5 bf915e8d112bfc267064a750737c25b7
SHA1 304736fe55e79b96c43589ea76e4f04081940fa9
SHA512 323db41d8b5801ca99230be8fda18c832ea398f9253b1403046b9034a82c141356e52a5f3a515a3d11e46f5dbd8b42e0dc0b1310a2fae72ce30016d5b500debb
SSDEEP 12288:IcZGxr/eXDTqoFekl9MBKdSXHG0YsaW8/:IW2rWfjerodSXWWW
TLSH
T149A42368049902F34CC26385E2641CE8D4454A3C9D56753BC6AAFBEA61B1D27FB2E87C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegisterRedo.gmcry

Path C:\Users\Admin\Desktop\RegisterRedo.gmcry
Size 312KB
SHA256 07a45a232bd81a3b8b9beb58ed64ebefe1b3026a26e6bb78e2de90fc4f853d2e
MD5 d1629e520ae0484b09ae7de9edc735c2
SHA1 639882c26f0904d7ec028f556fb1d8352c9bd0e9
SHA512 26b81af74206ea51467342296cbf12a547dc2655958bc88611490bfc49a057544cb55aec5aca1af6239e14b47385ff5ba986193e50f35e737bafd423fc41ac9a
SSDEEP 6144:YeWQ6iEUT1GunIrreMoNR1HNLdeeN30a+KPhtXepKrCFiW6QMXn6YHuJ7ELJBH4c:MPOzG4xdeQXP18tSOVkBYPX0
TLSH
T1DA64235CC52289B1BC898FF339E74C7226399A70A005A3D9FC19AB9FB58CE514ED3146
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartConvertTo.gmcry

Path C:\Users\Admin\Desktop\StartConvertTo.gmcry
Size 256KB
SHA256 bd09eefa2348c0037286f2e6da133280034d29685b51cd5acbe8bf0a7aed5398
MD5 fd0971698138fd88974404eccb9ee6f7
SHA1 a7427aabe51f14319f45746e4a0e3ae802644f10
SHA512 e5144f3221e71abab33c8cfda3fa316e0511283f62d237c57974306ab9da8347633f58fee4f47bcc6f7a5246c9554f216f899825a4895b46c821995f7d82db76
SSDEEP 6144:jkNgtQ/YrKZD2CWrZMR5fPqp9dMfB/e9nO8TFSwl8U7WgyUo:jkN8Q/rZa1np8/e9nBz2wo
TLSH
T13A4423FA9567A72B54ACA1B2F1287F6A5C87CED7A3B447CA0C034E2933453FF0916548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SuspendMove.gmcry

Path C:\Users\Admin\Desktop\SuspendMove.gmcry
Size 241KB
SHA256 2084e1527491d6a431642ecf66f68df76cf3101a31d5dd676a063a0640e49423
MD5 8cd6629e488ef7511259bb28316c7982
SHA1 62419ef765a2f17c6b13b04c0d7f40e3552d14a1
SHA512 eea69b857a84280447344d2e2c4778121f22b9db3c4129eadf2a843e7817865cd1f03912021871292e58f2bbcb2b06daff6ec8e2d7ef069d9ae0dedbbaddce81
SSDEEP 6144:Lnvtt24E8IV56NUZzhUoo9NOrWGRP+8Wlgs/j7WMapxD:6AUZahTEnRigYWXpZ
TLSH
T1B63423A5B22F25CDAED78FBDE940A5C71EA550CB030778181C365CB84B6D2F738A7846
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WaitCopy.gmcry

Path C:\Users\Admin\Desktop\WaitCopy.gmcry
Size 270KB
SHA256 3c01fd5a0d49a073bd971a088a55a7811f630d635b8904563be44113dcefcd1f
MD5 dde2bcf6ff9f299940599640cb6d919f
SHA1 95517012d7b1ab08c00f935e131aaefff97d90c2
SHA512 a57f8c95e9f78ab7a9f9c9110284089c04441ed6a6de8164ace3f79658e4b891a194d6ff9909610836971881e04bcaab435f2de8a9bff01e7deb3c5a839b2bbd
SSDEEP 6144:gwO6K68QKP9YJKSGHkJl43IMoKUe8LZTcQyv6Mk4c2XI:Lr8QKPRjH4G3cRdTcdv6MjpXI
TLSH
T150442387573EA3734B01AF29E5E3CAE74BC99C4396E08965AC58C5FCD05391D03AA1B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmRevoke.gmcry

Path C:\Users\Admin\Music\ConfirmRevoke.gmcry
Size 284KB
SHA256 8bdb76bf31181c57d8db024a2f89298a43a5de64527dc26248de63c1feb5fa0d
MD5 d091b00dbe69d3db7733031a48e43b86
SHA1 546e9445fbdb5360b016c69c78e9b40d298ebee5
SHA512 4c9b4aba01c95ea61e918e0e683f772ed4e810b63aa8f30a916036974784a08e09f0548b647e76c82a92c4861eab84b9a7197a933d11de98844be2c092e8e891
SSDEEP 6144:zJXPZnRuCxvsZzJwvw85qR4gVzEsPZoE4drToRu:dXNRuuvsZzJ2Rz0ZWdAA
TLSH
T1A25423AD8A095439DE87CD47C821AE5EAC6C740B709317BE91BD1F1A7019F71F9B02A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountWrite.gmcry

Path C:\Users\Admin\Music\DismountWrite.gmcry
Size 426KB
SHA256 5b9c076a69a31d2c042541260f4f68017dc3661b3ddc6bcce9e851c9f295e9ea
MD5 1edbcd1ecfe1f1f39ed5df8ce33ee3f1
SHA1 5cd884cb661fedb630ad7f505c5966e2064a3658
SHA512 dfaf87d2192b2d7c48672bf70d8d457a1ecfe5d32bd159677f5ef4dbdc6410ebb97a0f486df149b13d7d15e6410eead030abda0f800bb0c0e1ef0e965b65b0c5
SSDEEP 6144:VVfkMNn12T8SHxbP0UAyHBHrWprVeuOm145btxlyQLHpDnPfI84NkdBCFM+o7sp/:VdkeusUXDXm14hL7pLXIHfOCZZwS
TLSH
T15D94236B89574FA9CDA1BD00D58371337A99F7CCC2034A418E142AE33E5BFD951A1E8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnterConfirm.gmcry

Path C:\Users\Admin\Music\EnterConfirm.gmcry
Size 218KB
SHA256 1e5afce814fb4bee814055de1919be111032f6d9d757b9e54402dbdd3f9a7470
MD5 8ca5d558928f56a9957bbb5cae12ad3a
SHA1 4addfa8f3c65b15a9e2faa1fc65cb2512c87f02c
SHA512 363bb822e88a6a7fb4d055a1743281e7b6bbb65bef6316233071f9c2722b3c99fe6341d9c1bb3dad4196d2df2edf6fd73f28dae4f9d8e4e5ea176bcc18a3702d
SSDEEP 6144:0zLkL5BH/EZ18R42ViAaK6VgyUD52fg5Dbyc:HH/u1G42VXD6VOY6byc
TLSH
T159242331C4E1FA2196964C348582F5C62FAE6548E0CAFEC4C8B5F3E6A3F0D528E77046
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JoinSplit.gmcry

Path C:\Users\Admin\Music\JoinSplit.gmcry
Size 227KB
SHA256 f161ef1fd0218179c867c8048e1086c9d6a73395664ed4b8dd8c73ed7df3c44f
MD5 97339e155595c2c678f2389ade9c660e
SHA1 5caff42ddc7f16bc34ee7b83506f0879d1df1f5d
SHA512 57c1a8c9a83886418f58253bb0f9926d5465d34f734b451a362e22366999346b197dbbf646c90b6b667194f884ff890bf13581b9caaa7873ba296a4f3786f020
SSDEEP 6144:c5ukjKxkgW9qxbLoYQxm3LVIOVVYNiOo1Qd/NukN:RkjS7lolc3qTsOo4lukN
TLSH
T1E1341279E566439AEDED07A818906CAB1997042E3C0FAD4388468EED2D7FE773133534
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LockUnlock.gmcry

Path C:\Users\Admin\Music\LockUnlock.gmcry
Size 322KB
SHA256 72291b028ea86a09ce331195f9508d3746e51b102c06bb9e20fc1cdc836c4bdd
MD5 29c10ab9b8b5eb266827a5d8076d1069
SHA1 3abe6e023d4942b6f9af5fb10a6fd148490a3cc3
SHA512 2c8c7b2d3bb708cd72460d1037b5deb0196be0293fd9477b08652cf090bb60e4de1e40a724d1e737d6f25122122cedfbd67f97cc1d054ffd7794abded1068e14
SSDEEP 6144:FbktPrDKmtlt9ILMmma01vKNirzNGM+SmDDuts5wcBXTAMM8qdYWIX:FbkxrDKmtlKma01CNqzQM+SmDDUhMMrK
TLSH
T17964232CEEF9A83B9775ED82C3441873D6258A1AB410B45D3B7E7CFC0539F561288AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingApprove.gmcry

Path C:\Users\Admin\Music\PingApprove.gmcry
Size 445KB
SHA256 7280b529356121e191b05550075b29a66a52be4100c846dcef138cebe1935915
MD5 82084341b637166cf67c5bedf46aa7df
SHA1 150405151ab369ca0955f99fa8f89125ddabafd3
SHA512 3b431fefd6a3f5b210310239e9de79fdd3585ebd6e974466e359bd96321ce92c5143e35a25967dac1e52537feff16f43bd8805370bd90323b576e73b31de0d97
SSDEEP 12288:TGGa9SglH3TPYaP2SRipX8S1RJTqxWiOJtcU1T0V3K:TGd9SgVLYaP2SS11R0r6m5K
TLSH
T109A4239435D14E84CF45C708A32935CCCDF2A9AB0EA95E39A335EC0FE94858A2F1DD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopMerge.gmcry

Path C:\Users\Admin\Music\PopMerge.gmcry
Size 398KB
SHA256 e53e7378dbe23a6688bce48a7d89bde86122d5ede3d51ed6bbfe5123877293e1
MD5 ee50237b5a8ed3b0f82481c7333b2a97
SHA1 4a5b9c819ebc2243862bf4c12cb86f612ffbe144
SHA512 6dddb942bdefc19926622c3a8fcff5e7064b5ffa8b46cafbca8af1a7b405b1b90d615ed6ccb8d1e66b1d7567fa4309193236604e830ddcdea5bc1bafd39be971
SSDEEP 12288:ZErM1hHV+1CoAD7sFJK1rGRgVjtlz6oA2sv+94HbOj0:ZEIL1QCoHFhOR612smQOj0
TLSH
T18284230190DF393E33262BD7B99CC9723BE558586AF34F4CC925201D8E85369B6F49C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartWrite.gmcry

Path C:\Users\Admin\Music\RestartWrite.gmcry
Size 189KB
SHA256 953c1a35cfda5ed1388206095cac77adb70e5d63bba67f9347c3fb73d96a1f13
MD5 4c4cf1e01aeb8c63f91c17c6b5d30acd
SHA1 972c94b890cf68cd63cecd1355efebfdcb715c3c
SHA512 cb85c351352537d1937b1a00fa143732cda6328cc2367b8db3908ad945d1205ec5c2cb9aa961173677c4fea71f1f0b5e9cfdde9188485da5a49fe40c28513b14
SSDEEP 3072:Sxflz+GtBQYLcK6JkS+ameCVljVHajjyYn6tYoXb/osSbrhCe4TTulUzL8RHiAkM:ez9BtcKUkS+zeglda1AYMolIMUzWHilM
TLSH
T1EF14229E8D1C2AED077F12A22636334D9F62814A32B741BD61F5814BF5E435623E31AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoClose.gmcry

Path C:\Users\Admin\Music\UndoClose.gmcry
Size 274KB
SHA256 7ca39129e9fa3993b62c0a95bf7456b8f0d69ca0247d65a92a199bea94af47b1
MD5 2294e47683bebb60e30096daf0a71fca
SHA1 fc13cf812200a911de0d2926cd5217fe2d79067b
SHA512 1442acc56d8fbdc20445817713e76e2c17ec6f93b57d442d69aef2b82acde36df90524a8c9e6f58b6befd5903b0bc21a2c017e71cdb87fa1ed3ab947bd4939ad
SSDEEP 6144:Y56Nq68ZyXmLppoFrxNLrcXI78gHYW+1Z53y7KGde8lF54:YwqfZy6poFrrrcXfgx4M7veYFS
TLSH
T11954235255806A67166B404EE6771CCFB4927CAFDA60AC1E37F1F84EF84018F0C8E5AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnlockAssert.gmcry

Path C:\Users\Admin\Music\UnlockAssert.gmcry
Size 237KB
SHA256 57f0c24f8fb3972cf54a4ac72641246fbadfbe2b793d66dec55732063d02dc17
MD5 5d9bce3cf6c5adc9ed636401667a9f42
SHA1 c52322d9d717cc2a5d606898929d72d8c24a8554
SHA512 9ee68cd3fc0ebd3d4d42f442e221dd891faab2f895163dd99af50779e0868a3b13b88746e101a0286b8562583bca7ce7d1e9ef1331f84121b8f66ccb592f1ce2
SSDEEP 6144:UJYxCE1LFAWlzqIqFHDh6uXD0ooMCeamgqCWWkocNNbRgiqr:UQpRzMdIuQexglkLNgiM
TLSH
T14B341324A079FD953FC657C53FBCE8527AA33333F0BAAA44D1E51C39A6C18E4D41A650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CopyInvoke.gmcry

Path C:\Users\Admin\Pictures\CopyInvoke.gmcry
Size 948KB
SHA256 f2210b7025619b74b8ff4bc96152188a5a680eb8cf34fbd2c847b0819a89adcc
MD5 8913035d9570138e03597eb0820144d7
SHA1 a309c6ed34008ccfb2ba2a209cd9e900c4fc711c
SHA512 edb95e5b2fe04833161e39ef62ad781e90c8736c7f74b1edff2a8329f6eaea6b73b2fed8530fee22a357c49c02aa1a46b17ec0d8fef72e55e225be089a97d6e3
SSDEEP 24576:TJbC5QVw8yyw8c6Z1o/r6uELdvKktcA+Y73/1gJ8TlHZF3:TJu5QNyTaZ1omNKktv+69gJ8Tl5l
TLSH
T1F9253389925805DA0ACBC224CF3974ECE92199164EB9498EB72F5F71FC04E3BCB15C5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableReceive.gmcry

Path C:\Users\Admin\Pictures\DisableReceive.gmcry
Size 904KB
SHA256 1a6fe83e70f8fb65824b6b3206049cb05de3c3800ef50049d7b644a2dca2e642
MD5 9585977a4e4dd7351a7faacccb49e1ef
SHA1 d190689a772f07db2207ed9ccb4fa322b755c46b
SHA512 876e58c71b448b6b4809a42b549ddbea49b92f601717faa69222255a2079e49622476d71e1659e3256d1e3f9b55109f1bea31902b9d4211099e9cc465a726174
SSDEEP 24576:m3aqThqwOleSt8eir30FezgoiuzP3M7hN:cqwO3t8BUeURuzfqN
TLSH
T1441533332DC497F83129B39C4DB9A3F1E763328219DEB806DDC6D3689085E647AB46C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideCompress.gmcry

Path C:\Users\Admin\Pictures\HideCompress.gmcry
Size 1.1MB
SHA256 d4f088cdab2013c582ab5ba1dfa2383be91e588400018b9c0b530eb6342d4791
MD5 6eadd4aa03a64026150f22692bee018a
SHA1 a2b03228722c9ff642e4974943104538358002f5
SHA512 067c65e9e796b3875384bf178ec6495b8187d702fc3c816740b442791549978b010f0691434e0094eec39f5a1aae614915a934de5be5a0d5b0b00c95190b4b93
SSDEEP 24576:+W3v3Jm2uvwkQp/qQ3alaXtzsYCXvlh82P53ECeD0VKNAgv0+hV:n3Rm26wkQYctzsYCXvlh8K53Ec+X
TLSH
T1D63533B1B359120AF258D81257E8B0F9F6723AFF9F2C67851138BE594AF83C4F065624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InitializeUpdate.gmcry

Path C:\Users\Admin\Pictures\InitializeUpdate.gmcry
Size 772KB
SHA256 9813ef0373136551b7102b12ee854ce7f7e3efa0b04f2bee6bc3ad7b1c5f3e6e
MD5 46e8e44aafbd509a8e829585a44af8a0
SHA1 f33c541f5726b6a66ba8343eae77238e3bc38648
SHA512 2327b68b8e8e3b8c0cab690a6c1586d67c48cb50d9090d9197229209ba3809c81736001287dec6698dab5a373fc5dde4e286675ed4687bd63efd646a2c38af21
SSDEEP 24576:tojjd+y7RdaFaeZJapwFf190X+gtj92Q8nwnb/:+8CTbeoW19M8nwnL
TLSH
T1BDF433995F2D6D2A6B32E59AF3F93A84CBFFD6B1205400D57E609BDBA15E2C07D10C20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResolveLimit.gmcry

Path C:\Users\Admin\Pictures\ResolveLimit.gmcry
Size 1.2MB
SHA256 9d6c12b877388524e96c2c8ce67a440f099532b1f9b27e5a38cd8bcec4f859dc
MD5 cd6aee9f9cf5f2752ed9745ae0a0b1b3
SHA1 4eec873e50051832adc8248f6e79e6781bdb53a2
SHA512 e6fc5d9283850e79752ec1e0f0e6723d3779e1a69df4a256f0916d814c9ae8379bcc326a106e9e6cb359cd0e4a7e23fc60e1d138a9cd3469396e29f252a63fc6
SSDEEP 24576:Naj2pofHrR+oC6MceUns2FxKJ5g0vu0QhTS6c/xPKml392MdNLOiFy2BQQft:N42wHl+r6leUnsSa5dghLcZPl3MKFHXV
TLSH
T1AA4533199EF0EEFB42926286B75A842AC5F50C8F8470D66F6CDBB1CE5F840673C59D08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartUndo.gmcry

Path C:\Users\Admin\Pictures\RestartUndo.gmcry
Size 1.0MB
SHA256 62f72e90324bd3ed3144503ae863a8f7dae0a7bfa335bc47285444d48a90f4c9
MD5 2d038e2ae3357ddce8ef7ed91f574b4c
SHA1 f7794456782e790119492d4068dafe518b7ffdf2
SHA512 03053c0f28456fd2aef4e164e9e74c1793b3c7e2c0ea840f5e277abfc524dda4a43f042e7a6b7ef22dd446d83ed1e671719c9b6c53fb36e2311e5cd1eb976806
SSDEEP 24576:XxE0/3RFoNxmkfEKqShMlzPcx5KRf5Vq9l7/3U4kGXv+ghtzG+Po:hEK3Kxmq2xk2RhVo1vUbfZ
TLSH
T1FC35336935CD62B6A0EB8C212B104B99374FBF76D7041AD0B112BC5D90BB339B89D7B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevokeSuspend.gmcry

Path C:\Users\Admin\Pictures\RevokeSuspend.gmcry
Size 595KB
SHA256 6ac2e3735a12246f838016ca9827b733597c091a206704eeb09a4a63e6ed9483
MD5 28451cb82314a5ca832e9f7646b3058d
SHA1 2e9bcdb826a7ae99e825f3f4bdac2664756e97ac
SHA512 44f55cdc0b8731c62017dea349578173dc508bbd2db7d914ac02ebff25f6434c1cdc98105ee2a779486d68810ab8a2f7fcb09c329eaae27fd010b8e352c82db2
SSDEEP 12288:nCygLpv/MaVn2sczn4w5utDaRCU5b1+UCJM6EWcUogJMj5oD2:nCygRVR21zn4d9i5BwPhcUozuC
TLSH
T1FED42394009D779E3BB9C8E9F0811485F7C2B83CA6DA415B81E8FAA343D572D48BBC4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SubmitWait.gmcry

Path C:\Users\Admin\Pictures\SubmitWait.gmcry
Size 507KB
SHA256 e66781084c446147f0cd876b02e938a14be4fcbf17deb4b8a20e318fbe88575e
MD5 7afbfe0bff2e3cc2480092d700bd4bdd
SHA1 1e7873eb47f891e0d1517a68ba4c54bdfaa83089
SHA512 8922a2945938b272d20c79749d37abe70bb0fe13b28864dc003f54c9ed9d5b00b1210269936eb000d068c824664f78d12a3bc84e857f199c86c3f13fdc8d7a8a
SSDEEP 12288:fT4Hvvod29hpTi/xQw8XW1ZLvzKj/fYZaLnd5N:fTSvwo9bGGwOW1ZLuN
TLSH
T1B8B423E0C91A28D6FE27EB27C53C475F2C2FE65D2A21045FE827685178F2272AC17275
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YIvOc.gmcry

Path C:\Users\Admin\Pictures\YIvOc.gmcry
Size 25KB
SHA256 faef6a8a284f345860d61bcd3de460543b2fd27f9a862e8fd07235e42d0e85d2
MD5 877f11a9cddab8b189536e2d012905ae
SHA1 688c6d9485cd8a81e97ceb094a8ed30794568eee
SHA512 5f85526c99b1a94eb0d3c61b4ce1cf7ffa54d31781e4950063de8d02c450580a736563e1aa767626ad4e4935d657448538ae0fcad2ade386939a1896b72fe389
SSDEEP 768:mvO97nl/wnRlJVHJFJC4qeoN7P3gDgvC4fU33+8mff0wR2:m2V4FHJFJC4qnP3y4fU339mffRR2
TLSH
T155B2E0C88635CCDBB6866761AA373FF728A5C24B635684E9048DB74A87E9443C5C0F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-21-0x00000000068D0000-0x00000000068DA000-memory.dmp

Download

memory/2032-2-0x00000000050B0000-0x0000000005142000-memory.dmp

Download

memory/2032-0-0x00000000006C0000-0x00000000006D6000-memory.dmp

Download

memory/2032-3-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/2032-325-0x0000000005320000-0x0000000005330000-memory.dmp

Download

memory/2032-1-0x0000000005560000-0x0000000005B04000-memory.dmp

Download

memory/6052-1346-0x0000000000E30000-0x0000000000E3A000-memory.dmp

Download