asyncrat | 334b93afb2ddd91b0b8788990b3c43656cf2b952c666bfc17b25ea2162522fce

Analysis

max time kernel
809s
max time network
812s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
16-12-2024 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VenomRAT v6.0.3 (SOURCE)/BouncyCastle.Crypto.dll
Size

2.5MB
MD5

f0b3e112ce4807a28e2b5d66a840ed7f
SHA1

54a6743781fd4ceb720331fce92f16186931192d
SHA256

333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
SHA512

dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
SSDEEP

49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr

Score

10^/10

asyncrat default defense_evasion discovery persistence phishing privilege_escalation rat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

95.216.52.21:7575

Mutex

xdnqiaxygefjfoolgo

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449

Mutex

qzwnmervrwfc

Attributes

delay
1
install
true
install_file
servee.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/files/0x002600000004654b-1979.dat	family_asyncrat
behavioral1/files/0x00260000000465af-2012.dat	family_asyncrat
behavioral1/files/0x00280000000465c6-2033.dat	family_asyncrat

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
1776	7z2409-x64.exe
4816	7zG.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
5164	Client.exe
3440	Client.exe
4344	Client.exe

Loads dropped DLL 2 IoCs

pid	Process
3552	Process not Found
4816	7zG.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
468	pastebin.com
109	mediafire.com
112	mediafire.com
113	mediafire.com
464	pastebin.com
465	pastebin.com
466	pastebin.com
467	pastebin.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2409-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2409-x64.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z2409-x64.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0\0 = 7e00310000000000ba563294100056454e4f4d527e312e3328530000620009000400efbe90590d7890590f782e000000164d04000000030000000000000000000000000000007b4b0701560065006e006f006d005200410054002000760036002e0030002e0033002000280053004f005500520043004500290000001c000000	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0\MRUListEx = 00000000ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202020202020202	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\MRUListEx = 0100000000000000ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\MRUListEx = 00000000ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0\0	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0\0\NodeSlot = "25"	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2409-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\Shell	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = 010000000200000000000000ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25\ComDlg	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2409-x64.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0 = 7e0031000000000090590d78100056454e4f4d527e312e3328530000620009000400efbe90590d7890590d782e0000000a4d0400000002000000000000000000000000000000a5092600560065006e006f006d005200410054002000760036002e0030002e0033002000280053004f005500520043004500290000001c000000	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\2\0\0\1\0\0\MRUListEx = ffffffff	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\25	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	Venom RAT + HVNC + Stealer + Grabber.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2409-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2409-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	Venom RAT + HVNC + Stealer + Grabber.exe
Key created	\REGISTRY\USER\S-1-5-21-2934520114-3201407646-466687995-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE).7z:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2409-x64.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe
5164	Client.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2724	OpenWith.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1776	7z2409-x64.exe
Token: SeDebugPrivilege	1776	7z2409-x64.exe
Token: SeDebugPrivilege	1776	7z2409-x64.exe
Token: SeDebugPrivilege	1776	7z2409-x64.exe
Token: SeDebugPrivilege	1776	7z2409-x64.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeRestorePrivilege	4816	7zG.exe
Token: 35	4816	7zG.exe
Token: SeSecurityPrivilege	4816	7zG.exe
Token: SeSecurityPrivilege	4816	7zG.exe
Token: SeDebugPrivilege	2812	Venom RAT + HVNC + Stealer + Grabber.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	5164	Client.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	1868	firefox.exe
Token: SeDebugPrivilege	3440	Client.exe
Token: SeIncreaseQuotaPrivilege	3440	Client.exe
Token: SeSecurityPrivilege	3440	Client.exe
Token: SeTakeOwnershipPrivilege	3440	Client.exe
Token: SeLoadDriverPrivilege	3440	Client.exe
Token: SeSystemProfilePrivilege	3440	Client.exe
Token: SeSystemtimePrivilege	3440	Client.exe
Token: SeProfSingleProcessPrivilege	3440	Client.exe
Token: SeIncBasePriorityPrivilege	3440	Client.exe
Token: SeCreatePagefilePrivilege	3440	Client.exe
Token: SeBackupPrivilege	3440	Client.exe
Token: SeRestorePrivilege	3440	Client.exe
Token: SeShutdownPrivilege	3440	Client.exe
Token: SeDebugPrivilege	3440	Client.exe
Token: SeSystemEnvironmentPrivilege	3440	Client.exe
Token: SeRemoteShutdownPrivilege	3440	Client.exe
Token: SeUndockPrivilege	3440	Client.exe
Token: SeManageVolumePrivilege	3440	Client.exe
Token: 33	3440	Client.exe
Token: 34	3440	Client.exe
Token: 35	3440	Client.exe
Token: 36	3440	Client.exe
Token: SeIncreaseQuotaPrivilege	3440	Client.exe
Token: SeSecurityPrivilege	3440	Client.exe
Token: SeTakeOwnershipPrivilege	3440	Client.exe
Token: SeLoadDriverPrivilege	3440	Client.exe
Token: SeSystemProfilePrivilege	3440	Client.exe
Token: SeSystemtimePrivilege	3440	Client.exe
Token: SeProfSingleProcessPrivilege	3440	Client.exe
Token: SeIncBasePriorityPrivilege	3440	Client.exe
Token: SeCreatePagefilePrivilege	3440	Client.exe
Token: SeBackupPrivilege	3440	Client.exe
Token: SeRestorePrivilege	3440	Client.exe
Token: SeShutdownPrivilege	3440	Client.exe
Token: SeDebugPrivilege	3440	Client.exe
Token: SeSystemEnvironmentPrivilege	3440	Client.exe
Token: SeRemoteShutdownPrivilege	3440	Client.exe
Token: SeUndockPrivilege	3440	Client.exe
Token: SeManageVolumePrivilege	3440	Client.exe
Token: 33	3440	Client.exe
Token: 34	3440	Client.exe
Token: 35	3440	Client.exe
Token: 36	3440	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
4816	7zG.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe

Suspicious use of SetWindowsHookEx 63 IoCs

pid	Process
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1372	OpenWith.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
1776	7z2409-x64.exe
1868	firefox.exe
1868	firefox.exe
1868	firefox.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2724	OpenWith.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe
2812	Venom RAT + HVNC + Stealer + Grabber.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 2500 wrote to memory of 1868	2500	firefox.exe	83
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 4304	1868	firefox.exe	84
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85
PID 1868 wrote to memory of 2956	1868	firefox.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3 (SOURCE)\BouncyCastle.Crypto.dll",#1
1⤵
PID:3212

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2db426a-31c7-49b0-8bcc-d97dbb523032} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" gpu
    3⤵
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2372 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b44a619-8ad7-4c15-ad85-c59a8f0fd652} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" socket
    3⤵
    PID:2956
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3192 -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3148 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d1b0936-06e6-41a3-af9f-67d304643d2f} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:2080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4028 -childID 2 -isForBrowser -prefsHandle 4000 -prefMapHandle 4008 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab31a401-087d-4430-970f-9233394b065e} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:4236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5004 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4892 -prefMapHandle 4888 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b327f7aa-bf21-4310-b4fc-7fac496070d1} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" utility
    3⤵
    - Checks processor information in registry
    PID:1496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 3 -isForBrowser -prefsHandle 5516 -prefMapHandle 5524 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7e2a7b8-6218-4ba9-8616-eaf3333fd2a1} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:4752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5736 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5660 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59143db2-acde-49ef-a027-ccfc7648ebe3} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5852 -childID 5 -isForBrowser -prefsHandle 5932 -prefMapHandle 5928 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a1f07f5-da31-4ed8-a1fc-298a0ac4e05e} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -childID 6 -isForBrowser -prefsHandle 4824 -prefMapHandle 4684 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {753f8250-6f2d-40cc-b694-f4e5926405aa} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2908 -childID 7 -isForBrowser -prefsHandle 4804 -prefMapHandle 4388 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb341c56-a66b-435f-8996-b000b6600ad9} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:2688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2732 -childID 8 -isForBrowser -prefsHandle 6728 -prefMapHandle 4636 -prefsLen 27998 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d31c5c0-875e-4be7-9b21-ea63da8bac5b} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:2044
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5624 -childID 9 -isForBrowser -prefsHandle 5584 -prefMapHandle 5600 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cc94471-1d08-45de-b86c-0690dca5dfd7} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:3440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1444 -childID 10 -isForBrowser -prefsHandle 6396 -prefMapHandle 6392 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24d667cd-1471-4647-b5b2-ae941fc22fdc} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:4040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6696 -childID 11 -isForBrowser -prefsHandle 4564 -prefMapHandle 4688 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cd293bd-c2a4-4084-96b8-00ccaabb19ac} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:384
- - C:\Users\Admin\Downloads\7z2409-x64.exe
    "C:\Users\Admin\Downloads\7z2409-x64.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5760 -childID 12 -isForBrowser -prefsHandle 5776 -prefMapHandle 5444 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c57e2791-5ccd-4817-b81e-ec2f6a97353e} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:2072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5744 -childID 13 -isForBrowser -prefsHandle 7072 -prefMapHandle 5772 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6cf8b37-7908-4c5f-97b4-e3d15fd0cafc} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:1964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4724 -childID 14 -isForBrowser -prefsHandle 5868 -prefMapHandle 2720 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38e1dba2-2278-46ef-8b46-d95f2d663a7a} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:1016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7244 -childID 15 -isForBrowser -prefsHandle 7240 -prefMapHandle 7332 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2e3a54b-d287-4dfa-9c9e-0534beda0498} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:3964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6660 -childID 16 -isForBrowser -prefsHandle 3572 -prefMapHandle 4804 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b0483b-ae1e-40c2-b924-860067224ca5} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:5224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6604 -childID 17 -isForBrowser -prefsHandle 5468 -prefMapHandle 3244 -prefsLen 28338 -prefMapSize 244658 -jsInitHandle 1136 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f8cf070b-2f7f-4fdd-ab90-7c51fac6978d} 1868 "\\.\pipe\gecko-crash-server-pipe.1868" tab
    3⤵
    PID:5464

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1372

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2620

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\" -ad -an -ai#7zMap17472:108:7zEvent2049
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4816

C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2812

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:3672

C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Client.exe
"C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5164

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Executes dropped EXE
PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
88518dec90d627d9d455d8159cf660c5

SHA1
e13c305d35385e5fb7f6d95bb457b944a1d5a2ca

SHA256
f39996ab8eabdffe4f9a22abb1a97665816ec77b64440e0a20a80a41f0810ced

SHA512
7c9d7bd455064d09307d42935c57de687764cf77d3c9ba417c448f4f2c4b87bcd6fea66354dfe80842a2fa3f96c81cc25e8bf77307b4ace1bbe1346cbe68435f

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
c4aabd70dc28c9516809b775a30fdd3f

SHA1
43804fa264bf00ece1ee23468c309bc1be7c66de

SHA256
882063948d675ee41b5ae68db3e84879350ec81cf88d15b9babf2fa08e332863

SHA512
5a88ec6714c4f78b061aed2f2f9c23e7b69596c1185fcb4b21b4c20c84b262667225cc3f380d6e31a47f54a16dc06e4d6ad82cfca7f499450287164c187cec51

Download Submit
C:\Program Files\7-Zip\7zG.exe

Filesize
696KB

MD5
d882650163a8f79c52e48aa9035bacbb

SHA1
9518c39c71af3cc77d7bbb1381160497778c3429

SHA256
07a6236cd92901b459cd015b05f1eeaf9d36e7b11482fcfd2e81cd9ba4767bff

SHA512
8f4604d086bf79dc8f4ad26db2a3af6f724cc683fae2210b1e9e2adf074aad5b11f583af3c30088e5c186e8890f8ddcf32477130d1435c6837457cf6ddaa7ca1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg4xad17.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
b263beb2de097e37169641648cd91f91

SHA1
c5c48aef8442a789177e36525a9d0fa8aedd23fe

SHA256
77fefd81bb1cb48edcc10d5c2fae8e43d951cfb1a41c7466e40d5fc4ef013813

SHA512
b2f42ce0bde76b8059279407c3d9e6d50e87696b271dbfeedf452b24e1f81ee9b8e72c5987c762203e351ee0992754a3d740e543bb4a6bc181d052662bd1bb00

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg4xad17.default-release\cache2\entries\B12380E59E366D551CA91542483B50A71D3DB16C

Filesize
224KB

MD5
5c737e1a330c9f167401f21aed07082c

SHA1
e31829b7ff4f7ce58275f6db2ae591bdeb5b5888

SHA256
ba257584f284f543b5b22a1fffaea6c2975b0b465dfedd6404a227b2204708b9

SHA512
34dfcc70c193039edd938e68dde6bc668264070632471118900e4df692f0d274e58054a7f5362b2275e42d05258275ad1299c3a1468ef24fea73087f7133b151

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\mg4xad17.default-release\cache2\entries\C480DC2E887C2EC5556F7B69EB07B76AE5666CED

Filesize
443KB

MD5
27825d7f63b329acd76ebf4d4a1e9dda

SHA1
ee13ca33952a85cfdad6a0fb93f524b2c765710b

SHA256
0ad6ed89bcd188c5a735ab4e74e7a6515c8d4970f647073c4071273e89d127c8

SHA512
1ece268b2dc8f63af269f5b8e8b49b9127eef7d4ada628f30c75c6776448487c2bf3b6d7288b03dee69ac392034fa430807df081c33b40e7a53f3987cae9ff04

Download Submit
C:\Users\Admin\AppData\Local\Server\Venom_RAT_+_HVNC_+_Steale_Url_5eyyfdapldw2tryij3s5zga4ug2vjrbm\6.0.3.1\user.config

Filesize
1KB

MD5
3fb8d2a2cd510948957ef43af5de1a6a

SHA1
165c56b69c45db04546436b8cfcd21bf543fe1e3

SHA256
095a2b7ce003847ea27f3eb98eca1c5bf9098c194c137c550bed549fe8d46306

SHA512
ddf025953f0487612cab831866ce03285aa810a406d0a92d4491a2d26c7eaba2c4108c230309732a7ab6184c1578419164afe2fdc8e0179d8584bfbc7e75f1c6

Download Submit
C:\Users\Admin\AppData\Local\Server\Venom_RAT_+_HVNC_+_Steale_Url_5eyyfdapldw2tryij3s5zga4ug2vjrbm\6.0.3.1\user.config

Filesize
1KB

MD5
ec49b7f5618d420d4c61a527d52c2638

SHA1
4c627db09339ea9d8266671a866140c5c9377c89

SHA256
1e5fc255b1d6ff6b9fcb242f9aade5db7d5ce869a7bad4a216cf92c90f239def

SHA512
d33bbc0e55aa55a52b12a476d570bc2f2bb649313d416d94cd7bf73c0e76bdbf016b8cecf2eb3aaafb490e36238a8bec3e41e88201b65d032daaed757ddabd6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
25KB

MD5
1662c2737bae508c38a8d69962a13894

SHA1
ef3d92d578474467db1b823cc0ea09cfd75fbb48

SHA256
20859b0b49db0be6e53e72ddb8467fa3b57684965154efbafebef93efc8d40e3

SHA512
286c83edbebeccf5f69874fdd459b19dac8c1bd180ff78969e3d56c21c451561da304f4578d5a99b616c19f0c58ced2c1f458682d70f0e84358fac50faeef908

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
22KB

MD5
55d12badf92b26dc4d27ceaa7a3ca9fa

SHA1
49709241bec2a7e956e2e6a5290a796b3b8ea85b

SHA256
a7a24d1b26f9af7b0082048f6612500f89ca7508140b0d647aebb8a5578ba1b5

SHA512
f857916b4e68a6050eea0529b255e060b0cc43d1da4de7d7eeaa3d0c8afacab38223ae319653e22500e11547c85ee9ffa64df49d73dd4a0b05d710a64725fc08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
25KB

MD5
662ddd4ed3d9c2b2b3046372b1f44a0e

SHA1
8f1862a2d2cb5e3d9861b82b87fc5fc5cc9cacd6

SHA256
76df37c667b394809e565d919aa7ef542df288b13d697b5f99bfee02a608cb77

SHA512
4e4e9f1c5e3546c4d1838a7d890eaad7cf23e14c70d987e6bf1c891afb06fee14e5afed956ec6e557c4d5ed7e8268ff3b3096af09337ea48ab49386865d246c0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\AlternateServices.bin

Filesize
8KB

MD5
77408a83de125468472c82efba0ff4b2

SHA1
678abf0921de607aed254cb96524e1f6b5def609

SHA256
ad8b6805e7863ddd98495ed13559f8e7ca0d8df744067efe4ae8200adcd0adfd

SHA512
96cff22ce75bdb0adb28199641b3acb36026e3e4e40bd02de096dd21f9cc63b96cf98e8a56daf2e0f770c4708f2bb0ce2f7f674390e5b6062e53df4732123993

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
3dc65f9899fc8bbce794be32622bdfb6

SHA1
af9cdffe9757f3de4777fc6e3f970836f585ebb1

SHA256
de185be927dac03b90cc51f6fccf3d0e0658dade9e608362eb7ba4ed1bca48e8

SHA512
e8f5a05f5194966ce670fba44a65c48b1d3955644b1eddb4887ab76cc8be656e705b5bb63cc0a5d49e275b7039c71934e510fad7ab0236d375d3fd32fc16219e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
fab21f8028b25426f4bd8b22676d7268

SHA1
fe79425704e0668993ea4d3a84bb11e2aa085a56

SHA256
a0f25540e000ece28c58cc1d63475b2b7e68dcb1201beb1951625e4692cd9341

SHA512
9cbe166b721986a5befd243dfb4b75ec2112161ffbdf2b7d8d3e57bc00ceccc28eea4861666a8478d89da82332657e5e71c8eb9c1214d21180391f9eb78ace57

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
9912544a12a5042da40b09415c77c9a3

SHA1
bbcfaad127d1af9bcc0e76550f00804c3c224791

SHA256
d1953a90c8fde01429f5bc27631470ababc7da6bac0c521506d81a14c44bd339

SHA512
3f8a42f0fc2e6793142aabc485310ca559ab7a2ec66c23dddfca095f3ad16df39425ba8d7bd47301bd0345add2ad7ca2e4188430aca81fd6dd3d5e73bfc8dc6d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\db\data.safe.tmp

Filesize
81KB

MD5
1816b17c9fa21e954963eb2a76c32215

SHA1
ea5613858d2a2eb35e6805806a2d3eb337d05c5e

SHA256
aca38fe9fd88ed65f21ddaecdaf4db75b9563c97cf5c994d5b2ecd3fe3574fbc

SHA512
98fda86762793544b4ade05a71af70da0dc12b274c55a821ddd2fb61dcb8c948debc8595a314b3bbb9e07b161dfbeaf6a663904c570ccb0242b9cc138523089b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\129c352c-c720-4e4d-838c-b68592d3ffe4

Filesize
27KB

MD5
40043048b32736cea3ed66358e300fe6

SHA1
9d4719bb2cb3c1276bf23c123def46b719062aa5

SHA256
926b0df40e8450a3ee3c69d2dee612a23eb99f0b84fa8f44181426a0c159974a

SHA512
4f2f04229fc0e5919b68e534dba3a3caaeff2289f6cbd4605a2770fd7c75d0a39eceaf2964b35a0e696d3314ee7ae3a7f4b6cf35bdc721e668fed4143f24c6ca

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\1d693c8b-e715-42a9-8bb7-e5176e0f850d

Filesize
982B

MD5
ca114b277e5d0a5605b6b4a4c8de4b4a

SHA1
820351a7d21fd03d7acb75109fa1c3c05d77966e

SHA256
13c0cea862397b28bc2d8da2056d623a948d2a9ef9c1e67123a28a257a80460d

SHA512
feb1587aeed5e77197a96f360949d0ded470b5202dc2044f6faf9bf5dae4d7be66c9d5cc63cb355ebb7b96ee1ea55c7c720e48a2db0b8b6bced66fde5436e23d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\datareporting\glean\pending_pings\d150535e-988c-441d-bbc9-8a437630c5aa

Filesize
671B

MD5
e9a2b2cb99ef89905958190c44e71fde

SHA1
0759c7bf01cb4090f290546ca42bb006dcdd14fc

SHA256
90b3db5bfa763997c8a6eefa917d300f2b12bf1f0a716dbffda07d13960a6524

SHA512
c8acdea4fc400421a23cca5f434578990f25c1ccebeede6f90a8796364a62e57ee2df1869d2c7f781cf66132fc2930ee9b776d0f963bc27c27738309d20dd519

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs-1.js

Filesize
12KB

MD5
517fc307ecfba095a8b00e11d5c84c34

SHA1
a583d5b5592e068264485f5750d20a241755334a

SHA256
f8e699734d39532d8331efb18f688987c1f1aa4065bfc2074bb585324466b900

SHA512
1049fcaf3c2a770f25f0034182d542c607f61b3d0044bbd265dd42b89975c26f1c1763d31113131a6b088313d7f83ea29b51013a5065bbc034e224ddc31aca2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs-1.js

Filesize
10KB

MD5
4dc49a65728ef854b42b132d09c969cd

SHA1
0ae889b08bfac6bf19d1212b65bc423ef2c4847f

SHA256
c115d72fdeb82cd3919ba385f390de2ccad24b18ec83689af3ae32867a45c3db

SHA512
fb518e0f669bbf0b0152e2879baff7f87fb4402c9aa76c5e288073f74b04f5707ac52b706e54eebebcbda095c7e689e8132f61b7846cebfaddeb2665ea398542

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs.js

Filesize
10KB

MD5
1a64c24c580f97e8968c65dd772d14bf

SHA1
d9612f2163fc3d1513a70c0eca17b22dc9bfb6ab

SHA256
04ffba8ceb287c947ff510684f8ee1ca7df374a6303e6a7d3afe55df8e5bb853

SHA512
f7ab617f66f1e088894c0fa4a7e1f5918e1c5225782c46755a88cd2c716d8d450608a73c18acbbe391ede05276017f9aa29b36aafefa88335daf3de45ed199fc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\prefs.js

Filesize
11KB

MD5
eff87a346ba755e1fc1e3f63e7b24e6f

SHA1
843326120487fd098e5d202e07559a8510bbf246

SHA256
55e4e9bc33e18a2ad0774c3610985100418f3f72713eba7c238b3464ea56b0de

SHA512
ec31855f91692e2d0751406f4a30a625efd3e34a2d862c173f88d8eb922d7bcdb7c7ec8d9d812d985ce08be7741dd0e7e768a76f79bef5adeabbe9f4d609eb79

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
87bd15e87a8141137f48fcbab3e5c7ac

SHA1
ec15a3d218783ab7659e198c25c3382e330305eb

SHA256
7642b542a91c597bcbc4de051a6d6163c2beb2600f225a2abc252c6fc05e6aa8

SHA512
8d637bd7ac297bb44edcc2aa10f7ce910ed467e6bddc2bb4b06131f85ff2bb2c355b5f792a896ea61e91f8ebf092bb30ac5d445ac455c8b534f3722675ea3d1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
777acd7ea8dc71d9c04405a2cb376599

SHA1
a900c83b8ef07a6ae4345ad46ce3fb5ee0edd8e0

SHA256
d9bb25692b3948fbaac74416eb3985e393d7db967541a768216f02975fdd0389

SHA512
7ef1cc0f3413480526d429a4de74408dc0aa8d61b6d638637735f401465a57fb86b9b871f74214c3875f129901ef9a24f60440bcc22e490622c6eeb037780bd7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
9d08ef43b1b7a90e62994ab912f23b17

SHA1
ff206bed0042f5efb28088558f4319cfdd604517

SHA256
61b16e4426f2337db4c5035c76efbf50baefebfd8f20404cec2b36150193f37a

SHA512
73a71c751ad875ab422ab3aeb92fef4a13759b618cfc122abbc7a78eb4833acbbb16943adcfaab427a3730df7dbb6f2f930e3eefc20e07d1d5819327b7998912

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
e8c39cde587b1628899360951f1e8ea5

SHA1
d8ae155f37f022eeddf217ba2383975e77e0b9d0

SHA256
3af7f8fdeeadf1d14f8715e5f3876aab0ccea221ac7575156aee917094a1832c

SHA512
99c762065b7e3cc666c8bdedaf55c09ffcd5d96320cb75f1fcab22631d22c104323970304df2296104f2d51f9923433c10e3e2004f6f14d2eb0b5bd6152c11f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
756af9141b6f1d3842a515fdb71584e3

SHA1
7d2135d9cded15cec6c938ca35e3f103e10adedc

SHA256
c6f16d757f25b7002df336fdbed6e122fd746fc4253dbded45411fcde8060799

SHA512
7ac294b3b931f3414c107d2eb1519890520b269b63a5089b6dc8013f406c8d3558c3b8c7355f48b7f1d10a64f249d2ccea682f2c1c9a7b21e686b9c549ac3d45

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
eb207ceec1fef954fdd93ebf1afe289f

SHA1
9244eb0712cf6706405752837e407287d23fb1e9

SHA256
daecb1b026f906587b655e821e1523cfccf766115d621049d130e7512e55c46a

SHA512
46b6782def089861297c76caca6cdd0d1cd87aff8e13eaa5e85e2755064d04924d5cbdf7df20f01be3e0638752cc939a3a6ad1b6d6a1b37bd05bbdf3c4b5da22

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
65863e0fafde09349c38991ce9a9427f

SHA1
647baa24652c0934ff53d914513c2bb21c2abe70

SHA256
a0c1f8d3991f94bb28f702fe42f99a082ebb6fdddc3a1bf50c9b66350f40b1c0

SHA512
fd1ec75ab32351f0cf7f5c8a777abd84b8b567eaba4c9eeb4c382e4148b50bc50a7b69f476d646e39956d4da09644d38713a6ab2fd431c32333e9131c256afb7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
7d353a2594545405fa50d21cbaa77779

SHA1
5abc2acfb27c25cd52efef2c1a96793aa02fe9c2

SHA256
c892328d12d640d9d6ebcbedc7a20947424ebcf8e8da395532a8a4b3419fe19b

SHA512
307066cd43b67bd7a0f9b7d3a19860e2a9d1bbde93dfdd3b2bd894533f778e023cde459f579a97dd4027790cf2a0601bdf4daeab027af6a39f9c1bdf1dad874f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
1c7b2c4c47b00b16c2faa9be307bddbf

SHA1
c577cb2c6fb361da387ec98f5a9e9cc90612c27c

SHA256
77a7df1ca10af7cad16424a0bb8ab5850e8361f876f44955550bff5f4f5f4aaf

SHA512
8684da7e93430863a7ba7709e05e99f432af17799863beb982e72b8dffd7f4aef00eb681781d6823567f36f88c17f168f9ac05357340d2ba03c5a2802e97dea4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
8KB

MD5
145b9b3ec95da7e463d3fb2ecfc3f982

SHA1
0e5b83afa33d1d92343b793cbc9fc45f91bbec81

SHA256
83ad4582ccc144749ba56b031d51f512ed0f01378db882763fbd454af5e592aa

SHA512
a2a36b5a9026a33c743cdd2712be24cdbfd5951cfe75bad2b73d6d313f6fb83b112c370ea944580ac5c19bffdcc4674d4bbd1ca1fa6407e70c6dae17095e7fd1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
3e6a173f820f1acbfd846e103d7d628b

SHA1
528b617806e0102dca74a84eb423bb4ab7015d8e

SHA256
2bac779642ef26e97dfc168a0cb64c47f7ee7cf5f9c4cb3d90cace1ab51b850d

SHA512
5f1b343f21d6f314eee0ce6936e30d6fabf032f13264f0c309c41fda068a3df4ac1e2ded2b63f860b6ae5ed336ffa73b8528dea0a7e8b668683a98af7e69bde7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg4xad17.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
624KB

MD5
abc083417a774fcd60819870710e25cf

SHA1
b23e1da13d5324553969586ea4a9a607d655818b

SHA256
46a6ee6f23f8c8d315c83ffd5b56a77ce82dc3602468f4bb116977db76f7e0d8

SHA512
dde5723044c51ba8f7e0c62f311624e08b0b841d42bae3c1aa914b269663354a84ec6b986f1b7914ecf17c5c6c5b0293bf0a06ef2cd421aee0631df8e36dc1d8

Download Submit
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

Filesize
8B

MD5
cf759e4c5f14fe3eec41b87ed756cea8

SHA1
c27c796bb3c2fac929359563676f4ba1ffada1f5

SHA256
c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

SHA512
c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

Download Submit
C:\Users\Admin\Desktop\Client.exe

Filesize
74KB

MD5
3d05ca84c5a744ea1b9dd5f4857b7808

SHA1
3c625d88a663aed145237498555ffe78226c6098

SHA256
4bae8671296aab13c7c98e0f792dd7fd2e393e5dfc742edf88bd1b4f16588d47

SHA512
086b701c66df79befd7396fd7a8452a92941d8555e6f05c7bf777926e9c05d418b68bc79b1ab5327cf643708fe966646edd34484500b838f832055c659c8a108

Download Submit
C:\Users\Admin\Downloads\7z2409-x64.yQpCa_IF.exe.part

Filesize
1.6MB

MD5
6c73cc4c494be8f4e680de1a20262c8a

SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0

SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e

SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Client.exe

Filesize
66KB

MD5
3935ef8202cd8040741138a14b0655f0

SHA1
54cf02cf472111b57ac5329a408b2f858e2f3b86

SHA256
3a7efdc3d85adf7a5484ef17549db47be2a78b4b6892d93dd91958bb9a9edb82

SHA512
cbc24bde07ec9d1372869ce697ba3fcc76a7be2b75122af1f283160551dfc2dd18f77bc24ed0fff37b49dc7c8b0ffd41001f238595bec0c4761a5f4a79ec5ff1

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.Desktop.v22.1.dll

Filesize
838KB

MD5
e59c802bbbc1ebc554f3f7b6a3259ee1

SHA1
fdb4fa99e15d6519f18f7afe972fb2b128c5caf4

SHA256
d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6

SHA512
34aa13fd54fa262405e68c5f915192fe02b9d2c6560f36c5a5c93ec399407b47996e2d4ed88c22286cc6d578a4356353a9540a729684272611350c4665119e73

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.Data.v22.1.dll

Filesize
5.0MB

MD5
5c3017ec9073a7a4f3351440c3daaa8a

SHA1
ee1f73f8618439fc8a42f38b32760367bd5ce6b5

SHA256
e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33

SHA512
5d98631f754067e659400183134024cc2a4c22ba4a43ddf592791e01eca5cf1530eabcc4ee34beb7507c56dd02a80ba4704db389753a3119657e1d822c68c02a

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.Drawing.v22.1.dll

Filesize
291KB

MD5
cb877cd3b77a37f8e279fe7dc6b4ba6a

SHA1
a03989c1144a57e9088daa40f829a49298135b03

SHA256
bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930

SHA512
8dbbbe8606bd36c2efd4f456840c9cb5dd4966097f3a6a0e81104fe4a50695adf558612d74fd31978728455f699f6623e73dfd5e3fcd405e0afceebe83ddd97b

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.Printing.v22.1.Core.dll

Filesize
4.5MB

MD5
9ec835a4e269f978eeefd7fd8bd5abb0

SHA1
e36a07167bd83d713703a84f3c2c2b8f86cd38f5

SHA256
e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0

SHA512
2a72b3615215b94d1b7fce3c9ff28042c4c02ec655e3fdc42008217979b65f39fff9cb75a35ac1426a78aa2f8c0c00354369cdb5b5df155efcde8651878de4d9

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.Utils.v22.1.dll

Filesize
20.0MB

MD5
07adc748684fd33a198f2dc6eea12666

SHA1
28f62a05673447a3a347aa6a01ae8cd518126956

SHA256
50cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093

SHA512
893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.WinRTPresenter.Launcher.exe

Filesize
13KB

MD5
de4449ac523ac31f66efe7f090360f71

SHA1
de7fcb8c16c7cab8255b8e31781efb0ffc45acce

SHA256
76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db

SHA512
d43021c5878f08c38264e1882313959aa51b8dabf6649a64f476f3e7c0ba7fdaaac0f3edaa6fb3ea2e56889a5e78791236c1dfe8dbcd9218d7eab30a9ee4a56c

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.XtraBars.v22.1.dll

Filesize
6.5MB

MD5
8f335dc88eb706a7b50f45a3fd308dee

SHA1
1bcfb26b7e945fe29f40a1f2ad19c4be4d590edd

SHA256
3f31296a5be7c607874f4fd3e66df9d2c460edbc5c4b41ee5ce93534786310ac

SHA512
0d42472c287497878a08393b1b39608c0f466520b1ed9aac83fdbd25171941d40d0d0eb1012503894aaac5a5b64db7ea8d280df6d5f7afdd15490d4cee97ea00

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.XtraEditors.v22.1.dll

Filesize
7.7MB

MD5
9a4fa4e33d64f44451fc4223a5616355

SHA1
124caceb4e82537403a4b5e9b21487c369b69559

SHA256
fc4e229d2237af90eb1b76205b543098ee958cbc7558d7a6dab41b5210fdaef5

SHA512
869b25aa356a957ba361b4fcc1b3aa8363e7bd23a577538f904995ebaebb8a249398e35cf381f5ba06baed95c8dd3e5d6e3aea8efe5ac8e48ca2482c9d549bf9

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.XtraGrid.v22.1.dll

Filesize
3.6MB

MD5
8478f5aa3de612bd2cf5e9356688d0f3

SHA1
84103d2abee8976dcaac172bcb9e064dfd06a890

SHA256
ae22e7bebe5c4b59363c5980940c64608d1a35c6b5026e0e088605132187c8da

SHA512
d0f3cbf8144c733266e05b2513603f5b44bf6fa359bbff86c3d437e022ef1d6451ce7b3f335d116438346aeb3d93bc5a82a6a548a7b1795f72991112abe6750f

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\DevExpress.XtraLayout.v22.1.dll

Filesize
2.0MB

MD5
45d8d7bd5e30d8b5da44f6a60e331c87

SHA1
301d5dc4a8a1141234559df872ce219c1c7efccb

SHA256
e6e670bf76dc46e959f74b09d3c6e614b2121975456b00041e32bd7f5001253f

SHA512
23b303f287e0b77d221e8cd24cf2933d4976e9b61dfc9bd03c9f365d44988a0a7ce2e81366466dcdff981931099964ebc04293de2de039e0322eed9ac911291b

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Keylogger.exe

Filesize
10KB

MD5
b8607b7921cd9cba78058fcb56bcfb9d

SHA1
1344f12ff7e23122b62fcc7f3be548c73d3c3efd

SHA256
b2a992052d32a5b9d3702350b133289b45a8d209acd0161d9c3b0bc6fd702b3c

SHA512
dd36040e57f2744437684e257caac0987a90deac0a60536f1cb8d690e256505d427931a3beb8d58f87c2c1bf5beb0a40c4b09417c451a07e5856044efbac1449

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\MessagePackLib.dll

Filesize
16KB

MD5
06247396be54c6ebb06fd6ca84ee80cc

SHA1
51fb23ff498a47c0be900ae43a7030f98794eb59

SHA256
669e42b6c6e94dc2735f281aa5b33c0d398b91960158ec556e521974b3be5843

SHA512
03d93f22aaf1bc0dc4d26b130aa1cb1668c14b854ff84803c8b2cc74625cda44970dd5be1b17865986eabb6966a7d65c226282becfd7963b72b8035990ffc299

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Stub\ClientAny.exe

Filesize
71KB

MD5
958cfc3e7730a66a05d6b8a49ce13d63

SHA1
ebc55f86cccfead463fcc1e6a060a5012fb09907

SHA256
eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798

SHA512
cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe

Filesize
14.2MB

MD5
3b3a304c6fc7a3a1d9390d7cbff56634

SHA1
e8bd5244e6362968f5017680da33f1e90ae63dd7

SHA256
7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58

SHA512
7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\Venom RAT + HVNC + Stealer + Grabber.exe.config

Filesize
3KB

MD5
a1c2a2870001b66db41bcb020bff1c2d

SHA1
8c54c6a3564c8892aa9baa15573682e64f3659d9

SHA256
0aa9e3ab5c88c5761120206eff5c6e35c90288290b3647a942059705ef5b75e5

SHA512
b3bf53120203cfaa951f301b532849cb382d2404c9503916bc1ca39925a9a1530b01045f341fc75d47d65130d0187dcbbf4288b9ef46aa81624b59ba7802794b

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\VenomServer.p12

Filesize
1KB

MD5
65efef16af8b2bb993e24ca1fdb3f3a7

SHA1
e205dcc888582eb51d0ee9690d37a7b75138f715

SHA256
c40f74c79715de4c5265dffd643d7bd5dda2caa09ca84e620bc78f7d27df51fc

SHA512
29581484c44849ccd0ad9bd2c9058fc56f3589019baf4b833a5fc8ceea0e488a357639c92cbaf977f74d5f2d59abb2b8ee7a607cdc67c6c14592b4bd9c3a5215

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\cGeoIp.dll

Filesize
2.3MB

MD5
6d6e172e7965d1250a4a6f8a0513aa9f

SHA1
b0fd4f64e837f48682874251c93258ee2cbcad2b

SHA256
d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0

SHA512
35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

Download Submit
C:\Users\Admin\Downloads\VenomRAT v6.0.3 (SOURCE)\VenomRAT v6.0.3 (SOURCE)\dnlib.dll

Filesize
1.1MB

MD5
5cc2bb48b5e8c8ac0b99669401d15456

SHA1
02e9ae08f3ec364834eb3ffc122f1c90e1b0e95e

SHA256
648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea

SHA512
2867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420

Download Submit
memory/2812-1842-0x00000124EE7E0000-0x00000124EEE72000-memory.dmp

Filesize
6.6MB

Download
memory/2812-1836-0x00000124EAA10000-0x00000124EAAE8000-memory.dmp

Filesize
864KB

Download
memory/2812-1844-0x00000124EDC00000-0x00000124EDF9C000-memory.dmp

Filesize
3.6MB

Download
memory/2812-1849-0x00000124EF0A0000-0x00000124EF2B2000-memory.dmp

Filesize
2.1MB

Download
memory/2812-1960-0x00000124EDA70000-0x00000124EDB94000-memory.dmp

Filesize
1.1MB

Download
memory/2812-1846-0x00000124EF310000-0x00000124EF794000-memory.dmp

Filesize
4.5MB

Download
memory/2812-1855-0x00000124EAC10000-0x00000124EAC1A000-memory.dmp

Filesize
40KB

Download
memory/2812-1828-0x00000124E69B0000-0x00000124E77E4000-memory.dmp

Filesize
14.2MB

Download
memory/2812-1840-0x00000124EE020000-0x00000124EE7DE000-memory.dmp

Filesize
7.7MB

Download
memory/2812-1847-0x00000124E9F00000-0x00000124E9F20000-memory.dmp

Filesize
128KB

Download
memory/2812-1838-0x00000124E9F40000-0x00000124E9F90000-memory.dmp

Filesize
320KB

Download
memory/2812-1850-0x00000124EAFF0000-0x00000124EB09A000-memory.dmp

Filesize
680KB

Download
memory/2812-1834-0x00000124EA010000-0x00000124EA262000-memory.dmp

Filesize
2.3MB

Download
memory/2812-1832-0x00000124EA2D0000-0x00000124EA7E2000-memory.dmp

Filesize
5.1MB

Download
memory/2812-1830-0x00000124EB1C0000-0x00000124EC5C4000-memory.dmp

Filesize
20.0MB

Download
memory/3440-2035-0x0000000000C90000-0x0000000000CA8000-memory.dmp

Filesize
96KB

Download
memory/5164-1981-0x0000000000740000-0x0000000000756000-memory.dmp

Filesize
88KB

Download