Overview

overview

10

Static

static

CD91369257...EE.exe

windows7-x64

10

CD91369257...EE.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/11/2022, 15:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    CD91369257AB53EE337683DC26EFB1EE.exe
  • Size 1.6MB
  • Sample221130-szvxdsfb7w
  • SHA256 668daad8213376770747f3cffe6daed5d5630cbb3549859eeafea388a998dcb9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
dcratinfostealerpersistencerat

Malware Config

Signatures

  • DcRat 45 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Process spawned unexpected child process 44 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE 6 IoCs
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 11 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 44 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CD91369257AB53EE337683DC26EFB1EE.exe
    "C:\Users\Admin\AppData\Local\Temp\CD91369257AB53EE337683DC26EFB1EE.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\GefRRorceTempFilesUpBrat2\wYQDu2pz5IHASd8KUl.vbe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\GefRRorceTempFilesUpBrat2\NZMk6EtFnPGwTqqVtBLf6LRV.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
          "C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
            "C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Executes dropped EXE
            • Checks computer location settings
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3464
            • C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
              "C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe"
              6⤵
              • Modifies WinLogon for persistence
              • Executes dropped EXE
              • Checks computer location settings
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1256
              • C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe
                "C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe"
                7⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4372
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cb9517f1-983e-49ff-8c51-39bb4a51e32c.vbs"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2584
                  • C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe
                    "C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe"
                    9⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2400
                    • C:\Windows\System32\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\b34bf26a-f2dc-4966-9741-7d793ccb1e3e.vbs"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3628
                      • C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe
                        "C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe"
                        11⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4520
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5da87d77-6215-4d24-b2e6-72e0030ea8f2.vbs"
                          12⤵
                            PID:1340
                          • C:\Windows\System32\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\85f4fcb3-c18e-4be7-8b93-aeb9ca247d19.vbs"
                            12⤵
                              PID:1376
                        • C:\Windows\System32\WScript.exe
                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1abbad94-25f9-4ca6-8a42-1dac8c0c8cbd.vbs"
                          10⤵
                            PID:3324
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\28155709-6423-4afe-8000-7870827952f3.vbs"
                        8⤵
                          PID:4264
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "haTyOfficeClickToRun" /sc MINUTE /mo 6 /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:212
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "UeMOOfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2116
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "B9EvOfficeClickToRun" /sc ONSTART /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4856
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "OfficeClickToRun" /sc MINUTE /mo 7 /tr "'C:\odt\OfficeClickToRun.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1164
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "eTb6dwm" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.167.21\dwm.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4776
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "tzlkdwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.167.21\dwm.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1572
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fZL5dwm" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.167.21\dwm.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4536
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "dwm" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.167.21\dwm.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4636
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "MpmRWmiPrvSE" /sc MINUTE /mo 5 /tr "'C:\GefRRorceTempFilesUpBrat2\WmiPrvSE.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3468
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "wIsRWmiPrvSE" /sc ONLOGON /tr "'C:\GefRRorceTempFilesUpBrat2\WmiPrvSE.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4404
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "bSDDWmiPrvSE" /sc ONSTART /tr "'C:\GefRRorceTempFilesUpBrat2\WmiPrvSE.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4580
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "WmiPrvSE" /sc MINUTE /mo 9 /tr "'C:\GefRRorceTempFilesUpBrat2\WmiPrvSE.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:672
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "iQDWfontdrvhost" /sc MINUTE /mo 12 /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3708
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "Jf0zfontdrvhost" /sc ONLOGON /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1976
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "7rfsfontdrvhost" /sc ONSTART /tr "'C:\Documents and Settings\fontdrvhost.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4308
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "fontdrvhost" /sc MINUTE /mo 14 /tr "'C:\Documents and Settings\fontdrvhost.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3356
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "KJbuservices" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\services.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1780
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "gDymservices" /sc ONLOGON /tr "'C:\Windows\ShellExperiences\services.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1688
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "z4tFservices" /sc ONSTART /tr "'C:\Windows\ShellExperiences\services.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:5044
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "services" /sc MINUTE /mo 7 /tr "'C:\Windows\ShellExperiences\services.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3712
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "Qp9Pexplorer" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1160
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "ECzdexplorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4192
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "ofUVexplorer" /sc ONSTART /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1304
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "explorer" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4276
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "qtrXcsrss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Sidebar\Gadgets\csrss.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3108
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "cy1gcsrss" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\csrss.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4604
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "yYblcsrss" /sc ONSTART /tr "'C:\Program Files\Windows Sidebar\Gadgets\csrss.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1152
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "csrss" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Sidebar\Gadgets\csrss.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:384
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "S6OaRuntimeBroker" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3308
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "XPzhRuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4528
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "aaAVRuntimeBroker" /sc ONSTART /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4704
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBroker" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2780
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "PPW0spoolsv" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft\Temp\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4768
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "F5J0spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Temp\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2800
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "lN74spoolsv" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft\Temp\spoolsv.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4540
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "spoolsv" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft\Temp\spoolsv.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3856
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "8xbPSppExtComObj" /sc MINUTE /mo 9 /tr "'C:\GefRRorceTempFilesUpBrat2\SppExtComObj.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:3648
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "l1LfSppExtComObj" /sc ONLOGON /tr "'C:\GefRRorceTempFilesUpBrat2\SppExtComObj.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4044
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "iGRHSppExtComObj" /sc ONSTART /tr "'C:\GefRRorceTempFilesUpBrat2\SppExtComObj.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1804
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "SppExtComObj" /sc MINUTE /mo 9 /tr "'C:\GefRRorceTempFilesUpBrat2\SppExtComObj.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2424
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "j4FwGeforceERRxperienceBrat2" /sc MINUTE /mo 11 /tr "'C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4164
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "n6uKGeforceERRxperienceBrat2" /sc ONLOGON /tr "'C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:1496
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "TPs0GeforceERRxperienceBrat2" /sc ONSTART /tr "'C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe'" /rl HIGHEST /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:2540
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "GeforceERRxperienceBrat2" /sc MINUTE /mo 5 /tr "'C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe'" /f
            1⤵
            • DcRat
            • Process spawned unexpected child process
            • Creates scheduled task(s)
            PID:4332

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                GeforceERRxperienceBrat2.exe
                • Path C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\GefRRorceTempFilesUpBrat2\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                NZMk6EtFnPGwTqqVtBLf6LRV.bat
                • Path C:\GefRRorceTempFilesUpBrat2\NZMk6EtFnPGwTqqVtBLf6LRV.bat
                • Size 70B
                • SHA256 79137b57bd5ca9ccfeb88763fec1dcb346cb16a71d295dae62ac1b18ae3f9b83
                • MD5 SHA1 SHA512
                Submit Download

                wYQDu2pz5IHASd8KUl.vbe
                • Path C:\GefRRorceTempFilesUpBrat2\wYQDu2pz5IHASd8KUl.vbe
                • Size 237B
                • SHA256 bca396c571684f8c3a98d5f7c1e3d798a38a71013f79764b2e0a3b600abbe855
                • MD5 SHA1 SHA512
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\ProgramData\Application Data\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\ProgramData\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\ProgramData\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe
                • Path C:\ProgramData\GeforceERRxperienceBrat2.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GeforceERRxperienceBrat2.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GeforceERRxperienceBrat2.exe.log
                • Size 1KB
                • SHA256 29f5645ac14353ac460858f52c856548f3aeb144b09eef672a6b4849bafe742e
                • MD5 SHA1 SHA512
                Submit Download

                1abbad94-25f9-4ca6-8a42-1dac8c0c8cbd.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\1abbad94-25f9-4ca6-8a42-1dac8c0c8cbd.vbs
                • Size 512B
                • SHA256 b8196a04cf1faa5303eb3c185bd96c7dc0a18cbf021e1a70c9144ed1441217d4
                • MD5 SHA1 SHA512
                Submit Download

                28155709-6423-4afe-8000-7870827952f3.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\28155709-6423-4afe-8000-7870827952f3.vbs
                • Size 512B
                • SHA256 b8196a04cf1faa5303eb3c185bd96c7dc0a18cbf021e1a70c9144ed1441217d4
                • MD5 SHA1 SHA512
                Submit Download

                54961ebfb538700864d246608cc76842ee3339ba4.5.28[COLD_WAR]96640db2a07952e1380e9c7d2f997488cc380bb5
                • Path C:\Users\Admin\AppData\Local\Temp\54961ebfb538700864d246608cc76842ee3339ba4.5.28[COLD_WAR]96640db2a07952e1380e9c7d2f997488cc380bb5
                • Size 200B
                • SHA256 9204afd2f72c0cf7641b98166807987b4ee981da809bd90912342a1993adae62
                • MD5 SHA1 SHA512
                Submit Download

                54961ebfb538700864d246608cc76842ee3339ba4.5.28[COLD_WAR]96640db2a07952e1380e9c7d2f997488cc380bb5
                • Path C:\Users\Admin\AppData\Local\Temp\54961ebfb538700864d246608cc76842ee3339ba4.5.28[COLD_WAR]96640db2a07952e1380e9c7d2f997488cc380bb5
                • Size 452B
                • SHA256 dd6d55671a5c7e8a564ea27c7b57bbee2859abe38b28b47ca05ed8c3f99a2f3e
                • MD5 SHA1 SHA512
                Submit Download

                5da87d77-6215-4d24-b2e6-72e0030ea8f2.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\5da87d77-6215-4d24-b2e6-72e0030ea8f2.vbs
                • Size 736B
                • SHA256 83c229665a64d124e4b1eda57879d865002f9362dd4bf03fa5275e749b90c116
                • MD5 SHA1 SHA512
                Submit Download

                85f4fcb3-c18e-4be7-8b93-aeb9ca247d19.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\85f4fcb3-c18e-4be7-8b93-aeb9ca247d19.vbs
                • Size 512B
                • SHA256 b8196a04cf1faa5303eb3c185bd96c7dc0a18cbf021e1a70c9144ed1441217d4
                • MD5 SHA1 SHA512
                Submit Download

                b34bf26a-f2dc-4966-9741-7d793ccb1e3e.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\b34bf26a-f2dc-4966-9741-7d793ccb1e3e.vbs
                • Size 736B
                • SHA256 5a6d09c65458ffad7b2d19296e06cd2f7b3d65306154acb2ef9500ff9ed94ac0
                • MD5 SHA1 SHA512
                Submit Download

                cb9517f1-983e-49ff-8c51-39bb4a51e32c.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\cb9517f1-983e-49ff-8c51-39bb4a51e32c.vbs
                • Size 736B
                • SHA256 d1274fe6685fadb086670136726b6d6ab84c57e9c3d52e2bdd081dd4eab23928
                • MD5 SHA1 SHA512
                Submit Download

                e023edb72b70e67b42a6964eca4204a30e449d55.exe
                • Path C:\Users\Admin\AppData\Local\Temp\e023edb72b70e67b42a6964eca4204a30e449d55.exe
                • Size 1.3MB
                • SHA256 e7db3b1233b2e6733d67554ec66da389aa87681b15256a2ff029f41a795ca1ba
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/1256-153-0x000000001BD59000-0x000000001BD5F000-memory.dmp
                Download

                memory/1256-151-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/1256-157-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/2400-189-0x000000001D525000-0x000000001D528000-memory.dmp
                Download

                memory/2400-181-0x000000001B699000-0x000000001B69F000-memory.dmp
                Download

                memory/2400-193-0x000000001D514000-0x000000001D525000-memory.dmp
                Download

                memory/2400-194-0x000000001D525000-0x000000001D528000-memory.dmp
                Download

                memory/2400-192-0x00007FFE943B0000-0x00007FFE94E71000-memory.dmp
                Download

                memory/2400-191-0x000000001B699000-0x000000001B69F000-memory.dmp
                Download

                memory/2400-190-0x000000001D510000-0x000000001D514000-memory.dmp
                Download

                memory/2400-188-0x000000001D525000-0x000000001D528000-memory.dmp
                Download

                memory/2400-187-0x000000001D514000-0x000000001D525000-memory.dmp
                Download

                memory/2400-186-0x000000001D514000-0x000000001D525000-memory.dmp
                Download

                memory/2400-185-0x000000001D510000-0x000000001D514000-memory.dmp
                Download

                memory/2400-184-0x000000001B699000-0x000000001B69F000-memory.dmp
                Download

                memory/2400-183-0x000000001D510000-0x000000001D514000-memory.dmp
                Download

                memory/2400-175-0x00007FFE943B0000-0x00007FFE94E71000-memory.dmp
                Download

                memory/2400-182-0x00007FFE943B0000-0x00007FFE94E71000-memory.dmp
                Download

                memory/3464-146-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/3464-150-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/3860-139-0x0000000000DC0000-0x0000000000F14000-memory.dmp
                Download

                memory/3860-140-0x000000001BA90000-0x000000001BAE0000-memory.dmp
                Download

                memory/3860-141-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/3860-145-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/4372-170-0x000000001BB09000-0x000000001BB0F000-memory.dmp
                Download

                memory/4372-169-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/4372-166-0x000000001BB09000-0x000000001BB0F000-memory.dmp
                Download

                memory/4372-165-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/4372-164-0x000000001D290000-0x000000001D294000-memory.dmp
                Download

                memory/4372-163-0x000000001BB09000-0x000000001BB0F000-memory.dmp
                Download

                memory/4372-168-0x000000001D294000-0x000000001D297000-memory.dmp
                Download

                memory/4372-158-0x00007FFE943A0000-0x00007FFE94E61000-memory.dmp
                Download

                memory/4372-172-0x000000001D294000-0x000000001D297000-memory.dmp
                Download

                memory/4372-167-0x000000001D290000-0x000000001D294000-memory.dmp
                Download

                memory/4372-171-0x000000001D290000-0x000000001D294000-memory.dmp
                Download

                memory/4520-197-0x00007FFE943B0000-0x00007FFE94E71000-memory.dmp
                Download

                memory/4520-203-0x000000001B1A9000-0x000000001B1AF000-memory.dmp
                Download

                memory/4520-204-0x000000001C820000-0x000000001C824000-memory.dmp
                Download

                memory/4520-205-0x00007FFE943B0000-0x00007FFE94E71000-memory.dmp
                Download

                memory/4520-206-0x000000001B1A9000-0x000000001B1AF000-memory.dmp
                Download

                memory/4520-207-0x000000001C820000-0x000000001C824000-memory.dmp
                Download

                memory/4520-208-0x000000001C824000-0x000000001C827000-memory.dmp
                Download