asyncrat | dcb9b3bd02e4bca6dab8da73cfe8ff256cf70b2fef9aebd35f9c860b2e1df60e

Analysis

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-12-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VenomRAT v6.0.3.exe
Size

14.3MB
MD5

674fb9de862cbbb47a6ab5a7adb91d7e
SHA1

5895e99a1cb66771735bb93d6fc85110d064ac88
SHA256

dcb9b3bd02e4bca6dab8da73cfe8ff256cf70b2fef9aebd35f9c860b2e1df60e
SHA512

444d9c6519c1564520a93ca49edf1a7bb742043f53bcf3cb6fe7ae5561253515f39aa197cb39d10a140ac2fdf3b4986034d9f6f2264000965bd2eba94ec99602
SSDEEP

393216:vPv87RoDvSCG33lKqxsyEFfy1MpRt/RlY1V:vPv8727S/nweEFPRt5W1V

Score

10^/10

asyncrat xworm discovery execution persistence rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:4444

heheyanel.ddns.net:4444

Attributes

Install_directory
%ProgramData%
install_file
Activator.exe
telegram
https://api.telegram.org/bot7427144754:AAHRLM93AsaKo2dFejmZxunuQW0uH41yfn0/sendMessage?chat_id=7294780361

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x002200000002aaf6-22.dat	family_xworm
behavioral1/memory/3556-25-0x00000000003A0000-0x00000000003BA000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3736	powershell.exe
3856	powershell.exe
4888	powershell.exe
2804	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	venom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	venom.exe

Executes dropped EXE 4 IoCs

pid	Process
3528	Venom RAT + HVNC + Stealer + Grabber.exe
3556	venom.exe
4660	svchost
4296	svchost

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\ProgramData\\svchost"	venom.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133794593827404391"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\VenomRAT-V5.6-HVNC.rar:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3736	powershell.exe
3736	powershell.exe
3856	powershell.exe
3856	powershell.exe
4888	powershell.exe
4888	powershell.exe
2804	powershell.exe
2804	powershell.exe
3556	venom.exe
1388	chrome.exe
1388	chrome.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe
3556	venom.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4736	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	venom.exe
Token: SeDebugPrivilege	3736	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	3556	venom.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeDebugPrivilege	4660	svchost
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe
Token: SeCreatePagefilePrivilege	1388	chrome.exe
Token: SeShutdownPrivilege	1388	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe
1388	chrome.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
3556	venom.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe
4736	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3528	3864	VenomRAT v6.0.3.exe	77
PID 3864 wrote to memory of 3528	3864	VenomRAT v6.0.3.exe	77
PID 3864 wrote to memory of 3556	3864	VenomRAT v6.0.3.exe	78
PID 3864 wrote to memory of 3556	3864	VenomRAT v6.0.3.exe	78
PID 3556 wrote to memory of 3736	3556	venom.exe	83
PID 3556 wrote to memory of 3736	3556	venom.exe	83
PID 3556 wrote to memory of 3856	3556	venom.exe	85
PID 3556 wrote to memory of 3856	3556	venom.exe	85
PID 3556 wrote to memory of 4888	3556	venom.exe	88
PID 3556 wrote to memory of 4888	3556	venom.exe	88
PID 3556 wrote to memory of 2804	3556	venom.exe	90
PID 3556 wrote to memory of 2804	3556	venom.exe	90
PID 3556 wrote to memory of 3488	3556	venom.exe	92
PID 3556 wrote to memory of 3488	3556	venom.exe	92
PID 1388 wrote to memory of 4372	1388	chrome.exe	98
PID 1388 wrote to memory of 4372	1388	chrome.exe	98
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 2628	1388	chrome.exe	99
PID 1388 wrote to memory of 3436	1388	chrome.exe	100
PID 1388 wrote to memory of 3436	1388	chrome.exe	100
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101
PID 1388 wrote to memory of 896	1388	chrome.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
  "C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Users\Admin\AppData\Roaming\venom.exe
  "C:\Users\Admin\AppData\Roaming\venom.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\venom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'venom.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3856
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svchost'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2804
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\ProgramData\svchost"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3488

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd2edcc40,0x7ffbd2edcc4c,0x7ffbd2edcc58
  2⤵
  PID:4372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:2628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1880,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:3
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2176,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4396,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4772,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4804,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5092,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4964,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5096,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4912 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5220,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  PID:2820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4308,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5024,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5052,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3408,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4548,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5172,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5416,i,799310039360533134,3725032837555596629,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:1212

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:532

C:\ProgramData\svchost
C:\ProgramData\svchost
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\ProgramData\svchost
C:\ProgramData\svchost
1⤵
- Executes dropped EXE
PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2720913298431298fbef239e2feeb910

SHA1
8b99f466a0333b34ce463e7b1e2c012c3ed473c3

SHA256
a86ba559948a7b86b828c4b636bb808ed0f3a533be9d9a4280d09c1e8227c2aa

SHA512
0cb2319de78cd4a426e45afb3194983030c0bad1082898f20d49e92d94b323c45e44c3835de259254286bae023f45def661e9b85488d9dbbd9082d6e984e7b02

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

Filesize
38KB

MD5
c7b82a286eac39164c0726b1749636f1

SHA1
dd949addbfa87f92c1692744b44441d60b52226d

SHA256
8bf222b1dd4668c4ffd9f9c5f5ab155c93ad11be678f37dd75b639f0ead474d0

SHA512
be7b1c64b0f429a54a743f0618ffbc8f44ede8bc514d59acd356e9fe9f682da50a2898b150f33d1de198e8bcf82899569325c587a0c2a7a57e57f728156036e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

Filesize
20KB

MD5
0b17fd0bdcec9ca5b4ed99ccf5747f50

SHA1
003930a2232e9e12d2ca83e83570e0ffd3b7c94e

SHA256
c6e08c99de09f0e65e8dc2fae28b8a1709dd30276579e3bf39be70813f912f1d

SHA512
49c093af7533b8c64ad6a20f82b42ad373d0c788d55fa114a77cea92a80a4ce6f0efcad1b4bf66cb2631f1517de2920e94b8fc8cc5b30d45414d5286a1545c28

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000018

Filesize
37KB

MD5
56690d717897cfa9977a6d3e1e2c9979

SHA1
f46c07526baaf297c664edc59ed4993a6759a4a3

SHA256
7c3de14bb18f62f0506feac709df9136c31bd9b327e431445e2c7fbc6d64752e

SHA512
782ec47d86276a6928d699706524753705c40e25490240da92446a0efbfcb8714aa3650d9860f9b404badf98230ff3eb6a07378d8226c08c4ee6d3fe3c873939

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

Filesize
18KB

MD5
7d54dd3fa3c51a1609e97e814ed449a0

SHA1
860bdd97dcd771d4ce96662a85c9328f95b17639

SHA256
7a258cd27f674e03eafc4f11af7076fb327d0202ce7a0a0e95a01fb33c989247

SHA512
17791e03584e77f2a6a03a7e3951bdc3220cd4c723a1f3be5d9b8196c5746a342a85226fcd0dd60031d3c3001c6bdfee0dcc21d7921ea2912225054d7f75c896

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001b

Filesize
26KB

MD5
73fc3bb55f1d713d2ee7dcbe4286c9e2

SHA1
b0042453afe2410b9439a5e7be24a64e09cf2efa

SHA256
60b367b229f550b08fabc0c9bbe89d8f09acd04a146f01514d48e0d03884523f

SHA512
d2dc495291fd3529189457ab482532026c0134b23ff50aa4417c9c7ca11c588421b655602a448515f206fa4f1e52ee67538559062263b4470abd1eccf2a1e86b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
18KB

MD5
f1dceb6be9699ca70cc78d9f43796141

SHA1
6b80d6b7d9b342d7921eae12478fc90a611b9372

SHA256
5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

SHA512
b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

Filesize
58KB

MD5
6c1e6f2d0367bebbd99c912e7304cc02

SHA1
698744e064572af2e974709e903c528649bbaf1d

SHA256
d33c23a0e26d8225eeba52a018b584bb7aca1211cdebfffe129e7eb6c0fe81d8

SHA512
ebb493bef015da8da5e533b7847b0a1c5a96aa1aeef6aed3319a5b006ed9f5ef973bea443eaf5364a2aaf1b60611a2427b4f4f1388f8a44fdd7a17338d03d64a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001f

Filesize
39KB

MD5
a2a3a58ca076236fbe0493808953292a

SHA1
b77b46e29456d5b2e67687038bd9d15714717cda

SHA256
36302a92ccbf210dcad9031810929399bbbaa9df4a390518892434b1055b5426

SHA512
94d57a208100dd029ea07bea8e1a2a7f1da25b7a6e276f1c7ca9ba3fe034be67fab2f3463d75c8edd319239155349fd65c0e8feb5847b828157c95ce8e63b607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020

Filesize
105KB

MD5
b8b23ac46d525ba307835e6e99e7db78

SHA1
26935a49afb51e235375deb9b20ce2e23ca2134c

SHA256
6934d9e0917335e04ff86155762c27fa4da8cc1f5262cb5087184827004525b6

SHA512
205fb09096bfb0045483f2cbfe2fc367aa0372f9a99c36a7d120676820f9f7a98851ee2d1e50919a042d50982c24b459a9c1b411933bf750a14a480e063cc7f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

Filesize
53KB

MD5
2ee3f4b4a3c22470b572f727aa087b7e

SHA1
6fe80bf7c2178bd2d17154d9ae117a556956c170

SHA256
53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

SHA512
b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022

Filesize
88KB

MD5
76d82c7d8c864c474936304e74ce3f4c

SHA1
8447bf273d15b973b48937326a90c60baa2903bf

SHA256
3329378951655530764aaa1f820b0db86aa0f00834fd7f51a48ad752610d60c8

SHA512
a0fc55af7f35ad5f8ac24cea6b9688698909a2e1345460d35e7133142a918d9925fc260e08d0015ec6fa7721fbeae90a4457caa97d6ce01b4ff46109f4cd5a46

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023

Filesize
16KB

MD5
5615a54ce197eef0d5acc920e829f66f

SHA1
7497dded1782987092e50cada10204af8b3b5869

SHA256
b0ba6d78aad79eaf1ae10f20ac61d592ad800095f6472cfac490411d4ab05e26

SHA512
216595fb60cc9cfa6fef6475a415825b24e87854f13f2ee4484b290ac4f3e77628f56f42cb215cd8ea3f70b10eebd9bc50edeb042634777074b49c129146ef6a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
1c8bd188c4ae1e9c5f6869edccfe72cb

SHA1
2845af25625cc3a9396e123ab2e796c7261f17c2

SHA256
a5f4a384b6ddf2028a49b43bf5034c6e94c8163d49dfd361620fc472d96e4df8

SHA512
dca516e2a3785ed91fabe27bedf84e3a60148f0a27393b944d609a89605eb77006d57d7934a4a7d3a70cce8f4a54af00d3803c3eb7cddf5bf09410fcb0d5145a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
b20caa06a3bff128f0421cbe3ddb36a9

SHA1
18eaa8831c6210ede28ad968aaba8b22398299f7

SHA256
5e66bf3c842495ec385c9976295037aea6ba3163b79d3402f052d42543020ca2

SHA512
450cf3e84ec5df50649d3a1f625f0a269e3405b402094742c61f0f1e1fe4a47c07cc17f0eb8a39061e7ad261eb96eb040c1cfae447d463b57872be117f66c49d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
eddb61ca3220fff1594c03c1eb6f66b9

SHA1
42abae150500252d042061f108b79c67175c4b00

SHA256
efbdc7be384ea03d10c7b80deec6e54bf3b46f88fb012ddaec03c9bedee8515a

SHA512
ebf5a90503b3fbc4713396957130b5c9983f8b456134340947ff2a25193ec2eb01ba8b3e869444692bc5f9fc63b0227abd8bfd06003dcab6df29daed4ec1f977

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
febc6ecd6ad795b0c11951c5ed4fe262

SHA1
2a1f321d62e4a9eb5d76cad0e19d76527d871f59

SHA256
cc3cf70e6eb03e7ce57d67fc4c8a8004b6c6a67a5e21e69b00358a9953025697

SHA512
058878a6f71cf0a22b9f22ea62b331bbb5cc1999d5db4fb84ad5679d80740e8172c0fbab4b8d23436e960fde5d6ce3d4d7040318a48100004669bc891f20b35f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
02257ad66ab4b93b9948beb1f8fa3321

SHA1
e1032bf279e24c8f80fda91fa6b40209af0ac934

SHA256
350e91b9f5160bb073a840fe17d3b10bee306938eb091737ad2d818be1ec1d65

SHA512
6b925304199234fe938e9b15e8458358988daf7e30568e4f9392b727a0973ad88fb570b7d553ec57fea5c5e22583848740e435ee0d138524dfd8aa8142c21410

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
46275e32718548ccafbb029a5f9db870

SHA1
1c88f306c66db615e6d2337cd1430895456740b1

SHA256
32cc9d61126fe84fa81521da1fa3d2d43a9e9a8a49a05163f778c24519b9e251

SHA512
b554e803fc4c508659fe56e57b5a95c213d8099c8ed03b23c41e3321a206d3aab2c801ad74ac01caae65957f18fab04bee2475c153eb09d3b860f7574577b457

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6d6b2234cc2e6ef1b065145d69c2f8bb

SHA1
38509f0364767a09f08932d8868c96296354935a

SHA256
0799a77c43e43714942b6a86c2ef795365b5de86e222d10537aecb3928f92b08

SHA512
4ce118e409e1119023e59c2465eb7217719f6090355790112ff424c822325a494840c9349c8ccb97bf08956e9be916794d887ce08175b51a27612e7e81398b8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
e975df78d7219c060ad5a4fe8bd1f4a8

SHA1
d334027076e6f75f9ee30d7369fdeee6af315ae2

SHA256
d52d790038fd9bdad499497e9a43fdcd1b95470cdbbf78c40707aacdc800a7b5

SHA512
74be97f3027b007a6aa9ce55f623db37a74951f1936395db20076a1b1123017d11421c2d6dfbc6d3dd6638af04284c7c534099bead3df9530316bde58fda5884

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
352B

MD5
614302689617ed4104524bfa6b8bb90e

SHA1
2178a9ccc6915703369561009efea49a94c33881

SHA256
8a11c3bf545eeadc413468478f9b000ced921f779f1ebb9af369658c23b6f3ec

SHA512
90849ec5aec030b5c25be77780e5f4a176552e78b4138efe2e25cf2779081b3f7f58361ef4172856da9c77263e2f6401ef8747868a3c87f831cc5e346037ba23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b9e38bfd6ac9be3ddc61e94915f87e91

SHA1
508650338d59c7c15dbdc5c5e071ffc01e3b333e

SHA256
dcd9689b30d1f18ad78dd75db389b9c99c7d0e712bf4dbdc44e7942c67d15402

SHA512
0cab7e54892a9df9740bc561d89be6932ae0e33a3b1de21300134fdadb72ddb762172f7da63a39c2d5e24db8dce87651494097bcdc60ff0c076e1936c99d064a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
caee5349c031ac208105e8c53c334085

SHA1
eeb8df9562669469d91c6fc80db430b0aef06a1d

SHA256
cb3757128671c3e4e22548a026ec61c81dbe6aafb3d0e12fd8c4eb370b26804f

SHA512
7d1756539461e799f22d45066660254c52a02b8a8719952910fd4679e28ca08f11c2fe6d55a37dc5d3aadacf3f955b1e6e86fd08be1a15b58e7c4e46e73d1109

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e983af019a34c797f1f8e4c3ae202783

SHA1
e72846f9a6aeb8c10eacce17d4b6f3d987f2668c

SHA256
163e99dfa8b4ccc112c2069b0cedcce3da595113e4ebf30eed995d59357b42b9

SHA512
99f9d4d05933633a79b59010d0cbc694a87441ec79c57acb5473cee27705812e6221863935e8c05c0a86a03aac1bb13d4061dbe9ec2d5654bf10f6e88d5700d1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ccfb50e1234ba5801b53d0fefaaa069d

SHA1
c8dbef10abd0dec4cd63b34e18a5817aa4c4af1b

SHA256
40246b70ba9afb176437637274898f47b894b89709a7fcc79545300087c62f85

SHA512
29680a1bca4f434bbc9aceff63d963403f1202ce7dcff418e603a1b20e9b36fef36bfa39749fb6b5b589e56e799d327573eed7c2b373af6c672b032e935e1e7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4358fb9eac2f3e4e4860f77612253cbe

SHA1
b5fcff2c136184dd0bf3109de77836336c108940

SHA256
0ba26b5ccb501af16e2823d9ff4ed971808fcf7dc376ce5a8025aa28a6693855

SHA512
7714e377ef81bcf29cf3795f0a70768d62d0d82a841686a6913d45aa21fa6474b874042a69debfb61d122c65054d068a1faf5d7a4be0ada074a7441de5ad1ac8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2b9d3ac137706f1ef14a92ce413fc9d3

SHA1
f696de74c8fde489443470ccaae6aa34faedb1bd

SHA256
330a8c3ba07dc947f02487bb25548dce298ece933c3bebca8421335911cf3b50

SHA512
2297eab74e58bd4a1ffe0e0bcf7714dc982fbee594e68422ca8ba1425f089e192d63061545f66aed066ef25c7499afe33761725a8e2b37be0805572ec8fb4e1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
649a140401cd8e7085e4a0cf6cae4529

SHA1
0eebc100264b9e07aa5160dfdd360415433971ba

SHA256
5d7acdacfc951c0772fcad7145b42b046c8904cfa369f24c26db55f4c8fa14a5

SHA512
5e90fb37be346476e4fff088c6b8ee24bd568beefeee29f407e5d11d18d0b02325e012eebbdd837816c000a6c5fca892d8701e01bf88c260624f0afa8ef2a897

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f00f4f622ec7f3020be253bb6dcdf5f4

SHA1
8bf225a34b2d079e7793d1f06e38e37ec03a3d49

SHA256
701403409de4a4a8361aa5722b481f8bc68b459bc60f4c180905ea538afe8bba

SHA512
17bcfcea971157fa8fa51c6f8b354c0814d756142f8569452121347624ec6a84514ae4c764ee94d2e4e550204528326b545cfc2c47d366c25174c82e1f434b84

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fd5b07d6a46326b87350f9af2d870e3c

SHA1
28c92f55af15289be3a256f34f8311384fdfe673

SHA256
eabaca2a27a73f73c91f0aaa9d99f0c8081d5dc4bf617c9ee0fcc816b0667858

SHA512
4fc4bf73bb211e9c0239918e989f07cf374d4d777ce3cc34fa1671c80eeac9e5cb4922ae58f021e189089a9e5ed225d296ff88e9a0705a47002130b88a25656b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
d008757a48787fd7cbf752c371f01572

SHA1
7b54760f6f59092f7a4940999c596248d503db27

SHA256
44f7669643b8bea9d735a9a16b0000487d80becfda547767ce2d04e24b0e09c9

SHA512
46b3e5ae12b849a13d6bdbc442cae5895b1db24faf527467b485cbb4b5a87db80fc471887fb8553d4964500c01f9266b746eb4a46aae4e1361113381338561bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ae7e282b0986fe5599c759ec909ba999

SHA1
7b00ff6a588336ba7bd9c662c905257f02ef8998

SHA256
441626d691ad33b7613458b2bde1231ccaa9b6e1171902ae6864f939a19a0520

SHA512
b72754e49ddd7e9473fb1b3245728f529dfcc75c27c35dbd503b87de0f386bae0ebce1786a40991ca0e8901ae359a19dc49f464fa9f3f3eb51fad9024cc2ef51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
d7d4aada5c5721132e3e188fa8ef521c

SHA1
96cd49859b6a1e94fc9f75f05c2f937e4c0a30b3

SHA256
3a2664037a890160651eca4163e8b137a037449ad6b336ef5fec217737c46a3b

SHA512
1bed622e9f10f05c62bacbac5dc22ba1289437b8201c8eb6bd565429e63a2c826f7d9140df67514947e287f59fe55e995a172ff3e9513ae69a3a7c0c4943832c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
231KB

MD5
b7ba35f1991cd027c2f7703deb4928ed

SHA1
a9f77ac22877f3314819d7bc86b160bf69e27127

SHA256
6a83ebbf3e56905714b21aaf01eb7dbe91b0a5a5f30673e9e32491af9b327a17

SHA512
5d0b52ed94997550c7f36ef1832607dff9e969188ec20ab21bfe84b6a9fa3856e5f07eba524b0d93775a5c812c3fd77960c2c86eba5d85a996768a96b37a85e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e1406e40bc90234838ab278843448a11

SHA1
7e056692cfcf53a92ba8582a5fc0d2a418ef0c81

SHA256
fdc53165753f599dd5a22b0bd229f8e4c63e73dc47aece0b475c79a7255b1d10

SHA512
8ada81e44b16bfca0141dfe52a0b63e3cc7827b8dc45bfea87f834ffb759eeac87426c722b75fd76a447ab5efb69e0053b9fb34bd42d40b413a48f702eb70ab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0b59f3fa12628f63b5713c4833570d7f

SHA1
badcf18f1fdc94b1eadf63f27c09ad092c4a6ccb

SHA256
2332e52881483559d787508831c00192c4f0a4fedc232b0309e566a30247af1d

SHA512
01724fd9f7a20ec5ff3d2686593d5d95069135834e9b156ced36985067fb36e7b3ec2a0018e41fa125ad5d1e42c80be9e148632a9b655f2d41c1400a4320abe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_td0pp35t.osu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1388_527913898\94cfe6a6-3eab-4707-a0a9-18e10180894d.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1388_527913898\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe

Filesize
14.2MB

MD5
3b3a304c6fc7a3a1d9390d7cbff56634

SHA1
e8bd5244e6362968f5017680da33f1e90ae63dd7

SHA256
7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58

SHA512
7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5

Download Submit
C:\Users\Admin\AppData\Roaming\venom.exe

Filesize
81KB

MD5
ac5c47b2a86a3042f02e26a338e99466

SHA1
98e8c13d41179575145cdc800e603b467c2b18f1

SHA256
837d509ad49a587036361ee7fc30f5b18238bb98a310418298b5a6c1d350cb96

SHA512
8468268c03c0e286fdd767f961e90ade962ee46b8e12eddbb3204e77aa26475add2a8d8e61e6c8dd08952a0571942915b926192b34029155489813221d7135b3

Download Submit
C:\Users\Admin\Downloads\VenomRAT-V5.6-HVNC.rar

Filesize
44.7MB

MD5
3359e400772b429af1a1c5b2f06ad301

SHA1
bdedb4c410ba58392feefcda17ec18c9ec5e45db

SHA256
b460cb71a7c6a0ef8f1f92dc52c237a41a783fa5d2925362eb0ab3db51420e71

SHA512
63f5c3a773dc4d3ff44aef6b318e1e23c3befecf3a1263f4f45c132c487dae8fe9f0a2512a3699ae70c8b602ca83e672be8b18b0f9be60693c600a70b08f2f4a

Download Submit
C:\Users\Admin\Downloads\VenomRAT-V5.6-HVNC.rar:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/3528-29-0x00007FFBD8450000-0x00007FFBD8F12000-memory.dmp

Filesize
10.8MB

Download
memory/3528-26-0x00007FFBD8450000-0x00007FFBD8F12000-memory.dmp

Filesize
10.8MB

Download
memory/3528-27-0x0000015AC21C0000-0x0000015AC2FF4000-memory.dmp

Filesize
14.2MB

Download
memory/3556-25-0x00000000003A0000-0x00000000003BA000-memory.dmp

Filesize
104KB

Download
memory/3556-28-0x00007FFBD8450000-0x00007FFBD8F12000-memory.dmp

Filesize
10.8MB

Download
memory/3556-75-0x00007FFBD8450000-0x00007FFBD8F12000-memory.dmp

Filesize
10.8MB

Download
memory/3736-30-0x00000249D6BF0000-0x00000249D6C12000-memory.dmp

Filesize
136KB

Download
memory/3864-0-0x00007FFBD8453000-0x00007FFBD8455000-memory.dmp

Filesize
8KB

Download
memory/3864-1-0x0000000000580000-0x00000000013CE000-memory.dmp

Filesize
14.3MB

Download