GandCrab Ransomware Files

File Name Size Detection Count MD5
%SYSTEMDRIVE%\Users\fgery\AppData\Roaming\Microsoft\Windows\hhwdivrg\wjbhrrad.exe\wjbhrrad.exe 232,448 302 6b8e5833e38eb5104ecb2ffd96685f03
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_crysis.exe\avast_decryptor_crysis.exe 2,371,296 154 64049f1023e9aacf181a408317f8d552
%SYSTEMDRIVE%\Users\Family\AppData\Roaming\RFTJIMYULK.exe\RFTJIMYULK.exe 389,120 127 6a255e36ea02efae11ba373597bcafd4
%SYSTEMDRIVE%\users\fgery\appdata\roaming\info.exe 544,768 116 7c9447f9dd4c3cee90814dc849b9ff75
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_teslacrypt3.exe\avast_decryptor_teslacrypt3.exe 2,371,296 116 348cc165a4294e7c9d885f813a91bb62
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_cryptomix.exe\avast_decryptor_cryptomix.exe 2,371,296 94 b1b6d4af59ca743ccbad979c770ec0a1
%SYSTEMDRIVE%\users\user\winsvcs.exe\winsvcs.exe 131,584 93 d04edb76effb2758ae7bcce6e324bdd0
%ALLUSERSPROFILE%\CP8Z9ZN3KM.exe\CP8Z9ZN3KM.exe 608,768 92 bdc7130f8edce09b538b6ec22ea7a1aa
C:\Users\AGUYWH~1\AppData\Local\Temp\D04B.tmp.exe 542,208 87 53bfc34229191a3e8a90516ef8bf92ec
%SYSTEMDRIVE%\users\tneb\appdata\local\temp\csrss\scheduled.exe\scheduled.exe 3,225,600 84 f5f344be0ef1bd5c74143b9b8c15a5b9
%WINDIR%\rss\csrss.exe 3,226,624 81 976fe8aa3f9e19d3b3be5d03c81d437b
%ALLUSERSPROFILE%\csqfh\icqvb.exe\icqvb.exe 198,656 74 cdc6df34b337df4731bf0055c73c7d20
%SYSTEMDRIVE%\Users\Joyce\AppData\Roaming\Microsoft\Windows\uuibhcwv\radgdhed.exe\radgdhed.exe 229,888 67 46c555e1f356b81323120967141c71aa
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_hiddentear.exe\avast_decryptor_hiddentear.exe 2,371,296 67 5c55a1126dd6ed270b29f6d06f9e71e9
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_jigsaw.exe\avast_decryptor_jigsaw.exe 2,371,296 66 c2d139f16823b9d7afa03e433e319e79
%SYSTEMDRIVE%\Users\dell\Downloads\avast_decryptor_globe.exe\avast_decryptor_globe.exe 2,371,296 66 0ef8253b424c8422a1ddbc4634f1f4c1
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_noobcrypt.exe\avast_decryptor_noobcrypt.exe 2,371,296 65 64fd1b86c9b42947daa36737ba4d8a59
%SYSTEMDRIVE%\users\hiqai\appdata\roaming\info.exe 545,280 56 0680314293719a700b96e9294eeff0b9
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_encryptile.exe\avast_decryptor_encryptile.exe 2,371,296 50 0f9131cf2caa18f2a1938a0418fed356
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_szflocker.exe\avast_decryptor_szflocker.exe 2,371,296 50 55e389bda4c7ec2a79ffc63773d44c1a
%WINDIR%\t7086074708604070\winsvcs.exe 252,416 46 b80bcd7b7eda2f9fb1e272d762daabc1
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_stampado.exe\avast_decryptor_stampado.exe 2,371,296 45 b933e6e46ae2775793a007c35791407f
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_legion.exe\avast_decryptor_legion.exe 2,371,296 45 84e37ed0739d23b93634555e08071e69
%ALLUSERSPROFILE%\IU2MSRSJ7M.exe\IU2MSRSJ7M.exe 559,104 37 862736b5efac860a4b09b6a541332a2b
%ALLUSERSPROFILE%\jwadeb.exe\jwadeb.exe 218,647 34 832ad5f26958178abe0070db138ba542
%SYSTEMDRIVE%\users\karl\appdata\local\92772cc5-e184-497f-a81b-9af2be0fbb75\537c.tmp\537c.tmp 148,992 34 129707043708874a52fc5ac3acbffc37
C:\Users\Home\Desktop\New folder (2)\avast_decryptor_lambdalocker.exe\avast_decryptor_lambdalocker.exe 2,371,296 28 24cd122d04685239206b898aff0d4d21
%SYSTEMDRIVE%\Users\Combinationn\AppData\Roaming\Microsoft\Windows\dbssrgvi\iiesgfaf.exe\iiesgfaf.exe 200,704 26 98d46f6288da097849c44bbc8d2a44ab
%SYSTEMDRIVE%\Users\Dani\AppData\Roaming\Microsoft\Windows\baafbsvj\fcrhetwj.exe\fcrhetwj.exe 238,080 21 a371bf3e178045294dc62501c7fb2aad
%SYSTEMDRIVE%\Users\Sumon\AppData\Roaming\Microsoft\Windows\deufevcd\tascshdv.exe\tascshdv.exe 1,523,664 20 08029a30a9ef8f549d8bf0dd4eb46051
%SYSTEMDRIVE%\Users\Bruker\AppData\Roaming\Microsoft\Windows\ciggwrrh\ftdewuwg.exe\ftdewuwg.exe 235,520 19 4286c7b46d2d181e4feace1b42784287
%SYSTEMDRIVE%\Users\Jean Tavares\AppData\Roaming\Microsoft\Windows\sdwehfus\sgdjebgs.exe\sgdjebgs.exe 234,496 18 f22257222445c8192277805fd8e7330a
%SYSTEMDRIVE%\Users\ANIE\AppData\Roaming\Microsoft\Windows\iaetrtiu\dcactjju.exe\dcactjju.exe 237,568 17 a705d7376b1110f47a668b390415db9a
8d52271f44a87704bcf87e02a60034c3dd0af9f162b356e6c7089d269b9b52c2.exe 158,208 16 d703381d239005e76de2cbb9d398a4b3
%SYSTEMDRIVE%\Users\debra\AppData\Roaming\Microsoft\Windows\ffgjhguw\iasieawf.exe\iasieawf.exe 201,728 15 e702a7278807c1ecd4d1048ee029e13e
%SYSTEMDRIVE%\users\lenovo\appdata\local\temp\247792262717013.exe 949,248 15 382f8ab0cd4619aa1ffb2a05245a3322
%SYSTEMDRIVE%\Users\user\AppData\Local\TempQce34.exE\TempQce34.exE 197,576 14 062585ffab1dd3c90dddbf605f69ce42
%SYSTEMDRIVE%\Users\manoa\AppData\Roaming\Microsoft\Windows\vawiiegs\crhgjeti.exe\crhgjeti.exe 237,056 14 e10f65a67e38a6e88c525922420d9156
%SYSTEMDRIVE%\users\bubeski\appdata\roaming\microsoft\windows\wafuwftb\tcgsuttr.exe 235,008 14 71b518a2f8017401abba6c4a14762963
%SYSTEMDRIVE%\Users\ines\AppData\Roaming\Microsoft\Windows\baashssf\strgisfg.exe\strgisfg.exe 183,808 14 d8e1fe0c396e3cd42d829771634a9dd4
C:\Users\LPCNSHS\AppData\Roaming\Microsoft\Windows\jbjedeee\gevvfuaf.exe 237,568 14 0ea14a30531e78e3f3e353a27a74cce8
%SYSTEMDRIVE%\Users\Bruker\AppData\Roaming\Microsoft\Windows\ciggwrrh\ftdewuwg.exe\ftdewuwg.exe 237,056 14 cc24b663c1bbd4e8d0258a403174f5a3
%SYSTEMDRIVE%\users\ouyed\appdata\roaming\microsoft\windows\fhigwibf\dgdtfafb.exe 211,456 13 0ab05ddc382d239ac5bddd1e6df4ece6
%SYSTEMDRIVE%\Users\Acer\AppData\Roaming\Microsoft\Windows\ejwrhcvc\gtwvdwir.exe\gtwvdwir.exe 237,568 13 f9c860bccb377626a2a069347c527c9e
%SYSTEMDRIVE%\Users\WOCID\AppData\Roaming\Microsoft\Windows\cwsswwah\weuhgrws.exe\weuhgrws.exe 211,968 12 d0d6a5bd3933f0f0842ab49f33a0d4a8
%SYSTEMDRIVE%\users\bartek\appdata\roaming\microsoft\windows\frvwsdfw\avufcrve.exe 238,080 11 070c8222fc4fc9823765c44d7253e5a0
C:\Users\pc\AppData\Roaming\Microsoft\Windows\gsciteib\didsvfjw.exe 211,968 11 de75e395b93a197117064faa74ceb06a
%SYSTEMDRIVE%\users\usuario\appdata\roaming\microsoft\windows\uiiigavi\dtedriuf.exe 235,520 10 93716d8b6fc764cab5075d7a5736bdf5
c:\users\eshan\appdata\local\39aa9a21-42ad-4f79-9ae4-be5bc7f936f4\1a32.tmp 123,392 9 fabe78164f4f6e011d0c81921e17a4db
%WINDIR%\rss\csrss.exe 3,227,136 9 bbe8a137033204503d119b087c1a9335
%SYSTEMDRIVE%\users\hpc\appdata\local\temp\415483835236152.exe 940,544 9 d72b695886eca85f8b5dd4120bbc5304
C:\Users\admin\AppData\Roaming\Microsoft\Windows\tcwgjwht\habtrfcf.exe 201,728 9 47e93857b39d110939703cb231e4dfeb
%SYSTEMDRIVE%\users\khafagy - 0010\appdata\roaming\microsoft\windows\hssjjcta\edrthgic.exe 201,728 9 bf60f68c8555355c26b0da3f4f19b0ea
%SYSTEMDRIVE%\Users\XeoxSoft\AppData\Roaming\Microsoft\Windows\sswbicrs\jrbhusfj.exe\jrbhusfj.exe 237,568 8 7aab7c87bbbf6068549ad11e0bb13d42
%SYSTEMDRIVE%\Users\Tarik\AppData\Roaming\Microsoft\Windows\gfsadatc\vrgbedeu.exe\vrgbedeu.exe 237,568 8 6b6352e552d2476a38a6074d4bcd5046
C:\Users\Vicente\AppData\Roaming\Microsoft\Windows\rgfcasva\gevvejvv.exe 237,056 8 a0b7e46160c5db48ccb7f923bb6fb513
%SYSTEMDRIVE%\users\core i3\appdata\roaming\microsoft\windows\avrdeheu\tcavbeuw.exe 237,568 8 bad2da322b1ad9a5ba8faf889da02451
%SYSTEMDRIVE%\Users\AuRus\AppData\Roaming\Microsoft\Windows\dwbuwjii\tgegwatb.exe\tgegwatb.exe 194,048 8 fb6f5cd60f42f709499dd63ea2e0dc69
a257299b24c3b271d0b520fe03ad352eed2b9bca06b2f059b4da85b9c3e5df4e.exe 157,696 8 dfd5be2aeabc2a79c1e64e0b3a6dac73
%SYSTEMDRIVE%\Users\MASTER KEN\AppData\Roaming\Microsoft\Windows\tarcaitw\cajshset.exe\cajshset.exe 235,008 8 ab9d1e2426a66745fb93b6fb32d82f2f
C:\Program Files (x86)\Proxyfilter\Proxyfilter\digital0611_Good_4cr10.exe 514,560 8 1891e083e7de244ace749ed9872b17a0
%SYSTEMDRIVE%\users\lenovo\appdata\roaming\microsoft\windows\fhvgfhaj\brrdssce.exe 201,216 7 87c5d4fc7941b335dc36580fac1b91c3
%SYSTEMDRIVE%\users\mattex\appdata\roaming\microsoft\windows\recidsbe\crcfefwv.exe 183,296 7 cd18bee7cfaac340d7ba33558c5c8d21
%SYSTEMDRIVE%\Users\CLINIQUE2\AppData\Roaming\Microsoft\Windows\ejiascav\btjchwvu.exe\btjchwvu.exe 219,648 7 5a8f15550a0e91cecf942274e0142466
c:\users\carlos\appdata\local\temp\32630cnl.exe 308,224 7 c0645cee077359f0e7d0a98a4b23b22d
%SYSTEMDRIVE%\Users\komal­_pc\AppData\Roaming\Microsoft\Windows\cweaisdt\iavjbria.exe\iavjbria.exe 219,648 7 70fa2fbc3a6e572df9aff3d716fdc2a1
%SYSTEMDRIVE%\users\utente\appdata\roaming\microsoft\windows\utuwejew\cguwcbba.exe 202,240 6 1986f69bd17abc8692f193a9f1271aa1
0a8eee645fcc1af11959ed7c34839107b8d4600ae40c5e7b7f02d4304c7672a9.exe 222,208 6 e2d914cd9a884c2819cb103eb0cf1a54
C:\Users\Ana\AppData\Roaming\Microsoft\Windows\ftgaaurt\gtwviiis.exe 238,080 5 1fe6981c164d1eda8d27079bf819f791
%SYSTEMDRIVE%\Users\hhh\AppData\Roaming\Microsoft\Windows\cbaghhrr\sgjehvjf.exe\sgjehvjf.exe 200,704 5 959a0c350b2bdbf050efc19130333624
C:\Users\maria\AppData\Roaming\Microsoft\Windows\aiiesavr\revctccv.exe 201,216 5 5be895ed2655fec28ac92f470e7b7819
55cc84132a3f9f07341ae25b1db292992a576e9cdb7bac6cd9309a35d4d0a17b.exe 204,288 5 097d5d6c989e87aedbb5852b53e720de
%SYSTEMDRIVE%\users\ruiz\appdata\roaming\microsoft\windows\jvbdhiwf\itecrufd.exe 239,104 5 49655236d182d866506b2d606cc44336
C:\Users\IEUser\Downloads\GandCrab\4.exe\4.exe 127,488 5 a635d6a35c2fc054042b6868ef52a0c3
C:\Users\50022987\AppData\Roaming\Microsoft\Windows\utdaujvh\ieauustc.exe 127,488 4 126955163a22f542df64f23b56199940
%SYSTEMDRIVE%\users\clinnovo\appdata\roaming\microsoft\windows\budeabew\sgfgarrf.exe 202,240 4 e29306d26d442d8956301a4cb8df44bc
C:\Users\YO\AppData\Local\Temp\cre.exe 499,712 4 81d90927265623fe79439bde24f21cfd
%SYSTEMDRIVE%\users\jose gabriel\appdata\roaming\microsoft\windows\tveaitrr\eaicffbw.exe 183,808 4 582232fa2b022c81818e5c1df92b5961
%SYSTEMDRIVE%\users\elmehdi\appdata\roaming\microsoft\windows\hrarujuf\vgvhchcg.exe 219,648 4 48d2e91330400fb2e523301224caf6a8
file.exe 481,280 4 24f030b17dd8152a3cd04253dd648690
c:\users\malin\appdata\local\temp\14d2.tmp.exe 304,713 3 6f9f5082bd4bdc1ee12cabc8facda6a0
09df8d72d96c5feb160e633f388535a067c2dd7e14bc034e023c26a3dd7c61f6.exe 349,325 3 609aaa90f22b80e744c667e9a60fb694
%WINDIR%\t49596040302845030\winsvcs.exe 252,416 3 bd652f4458c9fcf294ebbde17f3a44f7
%ALLUSERSPROFILE%\dobs\mwnhi.exe\mwnhi.exe 171,520 3 48902f405a32380f4959effb26e64a0b
%SYSTEMDRIVE%\Users\freshtex\AppData\Roaming\Microsoft\Windows\dfaevfvi\iraarrbf.exe\iraarrbf.exe 201,216 3 be0e11a96d8aa3c64ecd71589b8621b0
C:\Users\m_toy\AppData\Roaming\Microsoft\Windows\tteudhfh\ggsgcraj.exe 238,592 3 95064dd2bdf8cbda944db1220a8534e8
c:\users\admin\appdata\local\temp\0000edb7.exe 567,808 3 3733146a787a5573fde29e2b1ee90b3f
%SYSTEMDRIVE%\Users\racun\AppData\Roaming\Microsoft\Windows\ijdhvahh\cgrvcvwe.exe\cgrvcvwe.exe 211,968 3 bcbf11f8d883287439d3e0c848298ae7
C:\Users\Karim\Desktop\Crack_Sony_Movie_Studio_13_Platinum_32_bit.exe 240,640 3 730102ccce86835c5cd7e9a775ad1c6f
C:\Users\paolo\AppData\Roaming\update.exe 226,816 2 5d5e650140b4edf19c6745abbae75f2d

Home > Threat Database > GandCrab Ransomware > GandCrab Ransomware Files