antarctida_stealer | 54154a472cf64c171cbd93d6e07d32c1b5115512d028734e711955a02a65b4c0

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plikan.exe
Size 2.1MB
Sample260809-wk361ashkb
SHA256 54154a472cf64c171cbd93d6e07d32c1b5115512d028734e711955a02a65b4c0
MD5 1426589d0fa33f94e2e4a808192705bd
SHA1 fb2d8bdb22e86d5aebb94e142cec4d3336e85696
SHA512 4cc4201997d4b69b0f7936e77d8988b05be671d2736c67b6a96269094eb4d711522dde142f5ce7c329b69ff1d0e398e7eee1f7f75907e62195bfd68d9032e870
SSDEEP 49152:whg+JpBjN+8CId/zhGheUbLx/8fkBE4sCtd1+3d:WRCId/1GhXx/Q34sCw3d
TLSH
T171A533C507A09A65E65B03B02D3CAA63D16F345DF824DF5C258A9207DFB4B718ECE4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution antarctida_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

antarctida_stealer

https://api.telegram.org/bot7234567890:AAHt4fLkz9wQ8xYp2BnM6vRcJ3sW7aE5dF0g/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8945623101:AAG7rP9sN2bXcVfR5tYhU8jKl3wQ6eZ1oA4/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8567890123:AAF5mN2pQrS7tUvW9xYzA4bC6dE0fG3hJ8/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8790123456:AAG9mN2pQrS5tUvW8xYzA3bC6dE1fG4hJ7/sendMessage?chat_id=7809455858
https://api.telegram.org/bot9012345678:AAH6kLmN4pQrS8tUvW2xYzA5bC9dE0fG3h/sendMessage?chat_id=7809455858
https://api.telegram.org/bot9123456789:AAE5kLmN9pQrS4tUvW6xYzA8bC1dE2fG3hI/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8345678901:AAE2gH7jK5lN9pQrS3tUvW6xYzA8bC1dE4/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8567342901:AAF3gH7jK5lN8pQrS2tUvW4xYzA6bC9dE0f/sendMessage?chat_id=7809455858

Mutex

23AGT69WVTNC3CD5

Attributes

Wifi
true
bot_token
7234567890:AAHt4fLkz9wQ8xYp2BnM6vRcJ3sW7aE5dF0g
browsers
true
chat_id
7809455858
crypto
true
gaming
true
grabber
true
hide
true
hosts
true
mail
true
messengers
true
mutex
23AGT69WVTNC3CD5
netstat
true
process_dump
true
product_key
true
screenshot
true
sockets
true
sys_info
true

Signatures

Family: AntarctidaStealer
AntarctidaStealer is an Windows stealer written in C#.
stealer antarctida_stealer

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	plikan.exe

Executes dropped EXE 46 IoCs

pid	Process
2144	Antarctida_0f0n0usa9hh9.exe
2868	Antarctida_4an4gsa32giq.exe
5088	Antarctida_4b6yp3in9wwp.exe
4168	Antarctida_4ofb6rsmmild.exe
4940	Antarctida_6mz21cxhs1tu.exe
2168	Antarctida_36yja3u37vnd.exe
4664	Antarctida_bya0g4vx2i0d.exe
2704	Antarctida_d3pdc7owpdt0.exe
3116	Antarctida_dp9hittxyh5a.exe
4900	Antarctida_gq1rwsnehpvx.exe
1072	Antarctida_hbdsvcrfkokj.exe
1284	Antarctida_hibu6njb1hbs.exe
4584	Antarctida_icmln5soaajv.exe
5980	Antarctida_jzu9wque3pea.exe
6592	Antarctida_n6tli5ilipd4.exe
5852	Antarctida_o2l7d9lw3q3m.exe
7084	Antarctida_qhxavz3ez0bs.exe
5344	Antarctida_sppw59vmzljt.exe
5968	Antarctida_wa65fg57rx04.exe
4224	Antarctida_yn62z54msax0.exe
5468	RD8ZzCUHY5qP.exe
2444	WinLock.exe
7988	RkilW7bAYVWk.exe
7948	UonmZB5tWXrS.exe
7228	fuJ4m3mAg0I8.exe
6456	RaaxZzoi2Ckh.exe
5808	J4IdhV0o1ITb.exe
7608	kZ9R4SA12s8K.exe
7520	9PUD9sduVauq.exe
5160	ukzvUja36ft8.exe
6672	UBudMK4OXGbG.exe
7796	XsVZHFra7imN.exe
6404	osCh6DhglNWH.exe
7776	dRHtNNakvB14.exe
6648	Tm9zuDIdUa0X.exe
2772	WDsSwwhi5tyW.exe
5820	WinLock.exe
6116	lk09tHpLw3b5.exe
7400	2xPSvo0Vprg0.exe
5164	q9gtImikPRPx.exe
7716	yOuIz20OuzlS.exe
6440	WinLock.exe
2700	uevAh0KgfcmO.exe
3368	WinLock.exe
1160	WinLock.exe
3404	WinLock.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 33 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GA1iQrbXKZmO = "\"C:\\Users\\Admin\\AppData\\Local\\yta9s8NZ66eS\\2xPSvo0Vprg0.exe\""	Antarctida_o2l7d9lw3q3m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\j7nvYc6XUqFR = "\"C:\\Users\\Admin\\AppData\\Local\\HhC5y5B79dq7\\J4IdhV0o1ITb.exe\""	Antarctida_6mz21cxhs1tu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iH9hH92RhzRV = "\"C:\\Users\\Admin\\AppData\\Local\\dX7tCBYRej2Z\\Tm9zuDIdUa0X.exe\""	Antarctida_sppw59vmzljt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5Pgt2oAwGjJf = "\"C:\\Users\\Admin\\AppData\\Local\\KCsJB4pITXz4\\uevAh0KgfcmO.exe\""	Antarctida_wa65fg57rx04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e8xoVla4ISMw = "\"C:\\Users\\Admin\\AppData\\Local\\JeucqwatpUnv\\kZ9R4SA12s8K.exe\""	Antarctida_dp9hittxyh5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\J1hX0Wb0oSPf = "\"C:\\Users\\Admin\\AppData\\Local\\R0ne45hFzmph\\XsVZHFra7imN.exe\""	Antarctida_36yja3u37vnd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0XWFjpTZqJRt = "\"C:\\Users\\Admin\\AppData\\Local\\BDZTzS0CJ3i6\\osCh6DhglNWH.exe\""	Antarctida_icmln5soaajv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ly6NjhhtV9km = "\"C:\\Users\\Admin\\AppData\\Local\\CGfeJ7LfjVE7\\lk09tHpLw3b5.exe\""	Antarctida_jzu9wque3pea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c2uDxzHOmbyU = "\"C:\\Users\\Admin\\AppData\\Local\\gLBik6trAvRN\\WDsSwwhi5tyW.exe\""	Antarctida_n6tli5ilipd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" /setup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OK7vjUXN8zbm = "\"C:\\Users\\Admin\\AppData\\Local\\Ku7i5eabNtQm\\UonmZB5tWXrS.exe\""	Antarctida_bya0g4vx2i0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vMM9Fw4MPB1P = "\"C:\\Users\\Admin\\AppData\\Local\\cQIaAAUpNYpc\\RaaxZzoi2Ckh.exe\""	Antarctida_4ofb6rsmmild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6pBNHtz6ZlBV = "\"C:\\Users\\Admin\\AppData\\Local\\OPRd2Zh3UOiP\\dRHtNNakvB14.exe\""	Antarctida_d3pdc7owpdt0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BrBoQDrUV5n5 = "\"C:\\Users\\Admin\\AppData\\Local\\9vf6rLWxx3xt\\q9gtImikPRPx.exe\""	Antarctida_qhxavz3ez0bs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BZu8eTlTUwg1 = "\"C:\\Users\\Admin\\AppData\\Local\\VmUXfCohDPDQ\\yOuIz20OuzlS.exe\""	Antarctida_yn62z54msax0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --wininit"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\X2WPYZ9a28j4 = "\"C:\\Users\\Admin\\AppData\\Local\\WmMWxcXQVtId\\fuJ4m3mAg0I8.exe\""	Antarctida_4b6yp3in9wwp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KIxL08c6cpwV = "\"C:\\Users\\Admin\\AppData\\Local\\5NiAC5p7ZCKI\\ukzvUja36ft8.exe\""	Antarctida_gq1rwsnehpvx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CzL7ofkmuGxg = "\"C:\\Users\\Admin\\AppData\\Local\\AXNUB3ccHXYz\\RD8ZzCUHY5qP.exe\""	Antarctida_hibu6njb1hbs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0Q4gmt5s7a9H = "\"C:\\Users\\Admin\\AppData\\Local\\Gl63sStvyWsZ\\9PUD9sduVauq.exe\""	Antarctida_hbdsvcrfkokj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --init"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\26ee03vvXC5g = "\"C:\\Users\\Admin\\AppData\\Local\\lH4duS1l9u6p\\RkilW7bAYVWk.exe\""	Antarctida_4an4gsa32giq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ezmiTs33VvH6 = "\"C:\\Users\\Admin\\AppData\\Local\\FXj1kwF3tXL7\\UBudMK4OXGbG.exe\""	Antarctida_0f0n0usa9hh9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe

Looks up external IP address via web service 1 TTPs 21 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
29	api.ipify.org
32	api.ipify.org
11	api.ipify.org
19	api.ipify.org
25	api.ipify.org
7	api.ipify.org
13	api.ipify.org
15	api.ipify.org
21	api.ipify.org
37	api.ipify.org
8	api.ipify.org
9	api.ipify.org
12	api.ipify.org
14	api.ipify.org
17	api.ipify.org
22	api.ipify.org
42	api.ipify.org
6	api.ipify.org
10	api.ipify.org
16	api.ipify.org
18	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2876	cmd.exe
3920	cmd.exe
3772	cmd.exe
5528	cmd.exe
4828	cmd.exe
116	cmd.exe
728	cmd.exe
5936	cmd.exe
3512	cmd.exe
3516	cmd.exe
1756	cmd.exe
1584	cmd.exe
872	cmd.exe
1416	cmd.exe
5900	cmd.exe
6728	cmd.exe
4008	cmd.exe
4180	cmd.exe
4124	cmd.exe
6924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yOuIz20OuzlS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_n6tli5ilipd4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fuJ4m3mAg0I8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tm9zuDIdUa0X.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kZ9R4SA12s8K.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lk09tHpLw3b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	osCh6DhglNWH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_sppw59vmzljt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_d3pdc7owpdt0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_gq1rwsnehpvx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_4b6yp3in9wwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_hbdsvcrfkokj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukzvUja36ft8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UBudMK4OXGbG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_0f0n0usa9hh9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_o2l7d9lw3q3m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XsVZHFra7imN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WDsSwwhi5tyW.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RaaxZzoi2Ckh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	J4IdhV0o1ITb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_6mz21cxhs1tu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 20 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
7580	netsh.exe
3048	netsh.exe
7008	netsh.exe
3316	netsh.exe
1472	netsh.exe
4408	netsh.exe
4820	netsh.exe
4852	netsh.exe
4512	netsh.exe
6488	netsh.exe
4284	netsh.exe
7652	netsh.exe
3908	netsh.exe
6072	netsh.exe
6992	netsh.exe
440	netsh.exe
6496	netsh.exe
5288	netsh.exe
6848	netsh.exe
6068	netsh.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Delays execution with timeout.exe 20 IoCs

defense_evasion

pid	Process
7616	timeout.exe
1860	timeout.exe
7188	timeout.exe
8048	timeout.exe
1352	timeout.exe
6956	timeout.exe
8036	timeout.exe
7940	timeout.exe
7848	timeout.exe
7768	timeout.exe
6628	timeout.exe
8116	timeout.exe
7932	timeout.exe
7856	timeout.exe
7704	timeout.exe
6556	timeout.exe
4512	timeout.exe
7864	timeout.exe
6460	timeout.exe
3716	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5056	schtasks.exe
2992	schtasks.exe
6732	schtasks.exe
6900	schtasks.exe
5444	schtasks.exe
2736	schtasks.exe
3472	schtasks.exe
728	schtasks.exe
4336	schtasks.exe
3408	schtasks.exe
996	schtasks.exe
680	schtasks.exe
2288	schtasks.exe
1448	schtasks.exe
6672	schtasks.exe
3280	schtasks.exe
216	schtasks.exe
2888	schtasks.exe
3716	schtasks.exe
5240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4524	plikan.exe
4664	Antarctida_bya0g4vx2i0d.exe
4664	Antarctida_bya0g4vx2i0d.exe
4168	Antarctida_4ofb6rsmmild.exe
4168	Antarctida_4ofb6rsmmild.exe
2868	Antarctida_4an4gsa32giq.exe
2868	Antarctida_4an4gsa32giq.exe
5088	Antarctida_4b6yp3in9wwp.exe
5088	Antarctida_4b6yp3in9wwp.exe
4664	Antarctida_bya0g4vx2i0d.exe
4168	Antarctida_4ofb6rsmmild.exe
2868	Antarctida_4an4gsa32giq.exe
5088	Antarctida_4b6yp3in9wwp.exe
4940	Antarctida_6mz21cxhs1tu.exe
4940	Antarctida_6mz21cxhs1tu.exe
4940	Antarctida_6mz21cxhs1tu.exe
2144	Antarctida_0f0n0usa9hh9.exe
2144	Antarctida_0f0n0usa9hh9.exe
2144	Antarctida_0f0n0usa9hh9.exe
2168	Antarctida_36yja3u37vnd.exe
2168	Antarctida_36yja3u37vnd.exe
4900	Antarctida_gq1rwsnehpvx.exe
4900	Antarctida_gq1rwsnehpvx.exe
2168	Antarctida_36yja3u37vnd.exe
4900	Antarctida_gq1rwsnehpvx.exe
2704	Antarctida_d3pdc7owpdt0.exe
2704	Antarctida_d3pdc7owpdt0.exe
2704	Antarctida_d3pdc7owpdt0.exe
1072	Antarctida_hbdsvcrfkokj.exe
1072	Antarctida_hbdsvcrfkokj.exe
1284	Antarctida_hibu6njb1hbs.exe
1284	Antarctida_hibu6njb1hbs.exe
3116	Antarctida_dp9hittxyh5a.exe
3116	Antarctida_dp9hittxyh5a.exe
1072	Antarctida_hbdsvcrfkokj.exe
1284	Antarctida_hibu6njb1hbs.exe
3116	Antarctida_dp9hittxyh5a.exe
4584	Antarctida_icmln5soaajv.exe
4584	Antarctida_icmln5soaajv.exe
4584	Antarctida_icmln5soaajv.exe
4584	Antarctida_icmln5soaajv.exe
5980	Antarctida_jzu9wque3pea.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	plikan.exe
Token: SeDebugPrivilege	4664	Antarctida_bya0g4vx2i0d.exe
Token: SeDebugPrivilege	2868	Antarctida_4an4gsa32giq.exe
Token: SeDebugPrivilege	2168	Antarctida_36yja3u37vnd.exe
Token: SeDebugPrivilege	4168	Antarctida_4ofb6rsmmild.exe
Token: SeDebugPrivilege	2144	Antarctida_0f0n0usa9hh9.exe
Token: SeDebugPrivilege	5088	Antarctida_4b6yp3in9wwp.exe
Token: SeDebugPrivilege	4940	Antarctida_6mz21cxhs1tu.exe
Token: SeDebugPrivilege	2704	Antarctida_d3pdc7owpdt0.exe
Token: SeDebugPrivilege	3116	Antarctida_dp9hittxyh5a.exe
Token: SeDebugPrivilege	4900	Antarctida_gq1rwsnehpvx.exe
Token: SeDebugPrivilege	1072	Antarctida_hbdsvcrfkokj.exe
Token: SeDebugPrivilege	1284	Antarctida_hibu6njb1hbs.exe
Token: SeDebugPrivilege	4584	Antarctida_icmln5soaajv.exe
Token: SeDebugPrivilege	5980	Antarctida_jzu9wque3pea.exe
Token: SeDebugPrivilege	6592	Antarctida_n6tli5ilipd4.exe
Token: SeDebugPrivilege	5852	Antarctida_o2l7d9lw3q3m.exe
Token: SeDebugPrivilege	7084	Antarctida_qhxavz3ez0bs.exe
Token: SeDebugPrivilege	5344	Antarctida_sppw59vmzljt.exe
Token: SeDebugPrivilege	5968	Antarctida_wa65fg57rx04.exe
Token: SeDebugPrivilege	4224	Antarctida_yn62z54msax0.exe
Token: SeDebugPrivilege	968	firefox.exe
Token: SeDebugPrivilege	968	firefox.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
2444	WinLock.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe
968	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
968	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2144	4524	plikan.exe	87
PID 4524 wrote to memory of 2868	4524	plikan.exe	88
PID 4524 wrote to memory of 5088	4524	plikan.exe	89
PID 4524 wrote to memory of 4168	4524	plikan.exe	90
PID 4524 wrote to memory of 4940	4524	plikan.exe	91
PID 4524 wrote to memory of 2168	4524	plikan.exe	92
PID 4524 wrote to memory of 4664	4524	plikan.exe	93
PID 2868 wrote to memory of 2888	2868	Antarctida_4an4gsa32giq.exe	96
PID 4524 wrote to memory of 2704	4524	plikan.exe	94
PID 4664 wrote to memory of 3280	4664	Antarctida_bya0g4vx2i0d.exe	95
PID 5088 wrote to memory of 2288	5088	Antarctida_4b6yp3in9wwp.exe	101
PID 5088 wrote to memory of 2876	5088	Antarctida_4b6yp3in9wwp.exe	102
PID 4524 wrote to memory of 3116	4524	plikan.exe	103
PID 4168 wrote to memory of 216	4168	Antarctida_4ofb6rsmmild.exe	104
PID 4664 wrote to memory of 3512	4664	Antarctida_bya0g4vx2i0d.exe	98
PID 4524 wrote to memory of 4900	4524	plikan.exe	108
PID 4168 wrote to memory of 1756	4168	Antarctida_4ofb6rsmmild.exe	105
PID 2868 wrote to memory of 4008	2868	Antarctida_4an4gsa32giq.exe	97
PID 2144 wrote to memory of 3716	2144	Antarctida_0f0n0usa9hh9.exe	289
PID 4940 wrote to memory of 3472	4940	Antarctida_6mz21cxhs1tu.exe	120
PID 4940 wrote to memory of 3920	4940	Antarctida_6mz21cxhs1tu.exe	121
PID 2144 wrote to memory of 1584	2144	Antarctida_0f0n0usa9hh9.exe	122
PID 3116 wrote to memory of 680	3116	Antarctida_dp9hittxyh5a.exe	124
PID 4524 wrote to memory of 1072	4524	plikan.exe	109
PID 4900 wrote to memory of 996	4900	Antarctida_gq1rwsnehpvx.exe	127
PID 2704 wrote to memory of 3408	2704	Antarctida_d3pdc7owpdt0.exe	128
PID 2168 wrote to memory of 5056	2168	Antarctida_36yja3u37vnd.exe	139
PID 2168 wrote to memory of 872	2168	Antarctida_36yja3u37vnd.exe	143
PID 4900 wrote to memory of 4828	4900	Antarctida_gq1rwsnehpvx.exe	134
PID 1072 wrote to memory of 4336	1072	Antarctida_hbdsvcrfkokj.exe	245
PID 3116 wrote to memory of 1416	3116	Antarctida_dp9hittxyh5a.exe	130
PID 5088 wrote to memory of 3908	5088	Antarctida_4b6yp3in9wwp.exe	133
PID 2868 wrote to memory of 4512	2868	Antarctida_4an4gsa32giq.exe	288
PID 4524 wrote to memory of 1284	4524	plikan.exe	131
PID 2704 wrote to memory of 4124	2704	Antarctida_d3pdc7owpdt0.exe	135
PID 4664 wrote to memory of 4852	4664	Antarctida_bya0g4vx2i0d.exe	136
PID 4168 wrote to memory of 4408	4168	Antarctida_4ofb6rsmmild.exe	137
PID 4524 wrote to memory of 4584	4524	plikan.exe	149
PID 1072 wrote to memory of 4180	1072	Antarctida_hbdsvcrfkokj.exe	144
PID 1284 wrote to memory of 728	1284	Antarctida_hibu6njb1hbs.exe	236
PID 1284 wrote to memory of 3772	1284	Antarctida_hibu6njb1hbs.exe	155
PID 4940 wrote to memory of 5288	4940	Antarctida_6mz21cxhs1tu.exe	160
PID 4584 wrote to memory of 5240	4584	Antarctida_icmln5soaajv.exe	159
PID 4584 wrote to memory of 5528	4584	Antarctida_icmln5soaajv.exe	170
PID 4524 wrote to memory of 5980	4524	plikan.exe	174
PID 2144 wrote to memory of 4820	2144	Antarctida_0f0n0usa9hh9.exe	175
PID 4524 wrote to memory of 6592	4524	plikan.exe	178
PID 2168 wrote to memory of 6848	2168	Antarctida_36yja3u37vnd.exe	179
PID 5980 wrote to memory of 6900	5980	Antarctida_jzu9wque3pea.exe	180
PID 5980 wrote to memory of 6924	5980	Antarctida_jzu9wque3pea.exe	181
PID 4900 wrote to memory of 6488	4900	Antarctida_gq1rwsnehpvx.exe	177
PID 2704 wrote to memory of 7008	2704	Antarctida_d3pdc7owpdt0.exe	182
PID 4524 wrote to memory of 5852	4524	plikan.exe	189
PID 6592 wrote to memory of 2992	6592	Antarctida_n6tli5ilipd4.exe	190
PID 6592 wrote to memory of 116	6592	Antarctida_n6tli5ilipd4.exe	191
PID 1072 wrote to memory of 6072	1072	Antarctida_hbdsvcrfkokj.exe	193
PID 5852 wrote to memory of 2736	5852	Antarctida_o2l7d9lw3q3m.exe	196
PID 1284 wrote to memory of 440	1284	Antarctida_hibu6njb1hbs.exe	198
PID 5852 wrote to memory of 3516	5852	Antarctida_o2l7d9lw3q3m.exe	197
PID 3116 wrote to memory of 3048	3116	Antarctida_dp9hittxyh5a.exe	200
PID 4584 wrote to memory of 6992	4584	Antarctida_icmln5soaajv.exe	204
PID 4524 wrote to memory of 7084	4524	plikan.exe	206
PID 7084 wrote to memory of 6672	7084	Antarctida_qhxavz3ez0bs.exe	282
PID 7084 wrote to memory of 6728	7084	Antarctida_qhxavz3ez0bs.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\plikan.exe
"C:\Users\Admin\AppData\Local\Temp\plikan.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "vV298rx2NTgJ" /tr "\"C:\Users\Admin\AppData\Local\FXj1kwF3tXL7\UBudMK4OXGbG.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\2a10895c04b74bdfb353830950585a9b.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1584
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7932
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4820
- C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "z0ujd6pRvtCc" /tr "\"C:\Users\Admin\AppData\Local\lH4duS1l9u6p\RkilW7bAYVWk.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1c0d4bf68f5840c4abe2646c1cd9a118.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4008
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7864
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4512
- C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "pYqHXUeoienj" /tr "\"C:\Users\Admin\AppData\Local\WmMWxcXQVtId\fuJ4m3mAg0I8.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4e3eabc3f32d40cbbab98a4251332dac.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:7856
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3908
- C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "TDXrElJdRksX" /tr "\"C:\Users\Admin\AppData\Local\cQIaAAUpNYpc\RaaxZzoi2Ckh.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:216
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\077c525b1a794b1585d5b2a9b8995286.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7848
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4408
- C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "zoc7d8WbG4Yl" /tr "\"C:\Users\Admin\AppData\Local\HhC5y5B79dq7\J4IdhV0o1ITb.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\5ab753f24ae94ce1b32e3183ca2ab094.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3920
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:7940
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5288
- C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "b8pFFvUSbkrm" /tr "\"C:\Users\Admin\AppData\Local\R0ne45hFzmph\XsVZHFra7imN.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5056
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\fd4dbb1284b445c3a5b926d0d6df5d33.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:872
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:8048
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6848
- C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "MBZaPjWfYI36" /tr "\"C:\Users\Admin\AppData\Local\Ku7i5eabNtQm\UonmZB5tWXrS.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\92fdc6c9871c498c8eac329799217c8f.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3512
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7768
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4852
- C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "8ea1CTEsWY4g" /tr "\"C:\Users\Admin\AppData\Local\OPRd2Zh3UOiP\dRHtNNakvB14.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\801ba3848eee4b6490f72179255123a9.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4124
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6628
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7008
- C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "D3IXT94qF6UC" /tr "\"C:\Users\Admin\AppData\Local\JeucqwatpUnv\kZ9R4SA12s8K.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:680
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\71174cdd33b841f3b740c5b1a637181f.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1416
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1352
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3048
- C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "DDH4rU6376g1" /tr "\"C:\Users\Admin\AppData\Local\5NiAC5p7ZCKI\ukzvUja36ft8.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6cf1d4bcadcb403c9df4d12a7eec2311.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4828
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:8036
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6488
- C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "BMScD6fLgqFy" /tr "\"C:\Users\Admin\AppData\Local\Gl63sStvyWsZ\9PUD9sduVauq.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6090dfe54ed84ad0ace21499ed15386b.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4180
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6460
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6072
- C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "vPC6ZQ6Pnp0u" /tr "\"C:\Users\Admin\AppData\Local\AXNUB3ccHXYz\RD8ZzCUHY5qP.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:728
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\275d042329db4a239acbb6e1c3b71251.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3772
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:8116
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:440
- C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "pIBm5YUcLLvo" /tr "\"C:\Users\Admin\AppData\Local\BDZTzS0CJ3i6\osCh6DhglNWH.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ca12b9720fc243ddb6882c2a724a3a3a.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5528
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6956
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6992
- C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "mRTlHlSJlBef" /tr "\"C:\Users\Admin\AppData\Local\CGfeJ7LfjVE7\lk09tHpLw3b5.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6900
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\21f27e922e714df398061958b44ca65f.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6924
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:7616
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3316
- C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6592
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "PrB7AVJyJbQS" /tr "\"C:\Users\Admin\AppData\Local\gLBik6trAvRN\WDsSwwhi5tyW.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\e05a1392bec840aca6518eed8ec3069e.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:116
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7704
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4284
- C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "bfLcZZOlRtjg" /tr "\"C:\Users\Admin\AppData\Local\yta9s8NZ66eS\2xPSvo0Vprg0.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\494823f630934d6a923586faae5d19d7.bat"
    3⤵
    - Executes a command shell one-liner
    PID:3516
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1860
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1472
- C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "Auv5jKrVN24G" /tr "\"C:\Users\Admin\AppData\Local\9vf6rLWxx3xt\q9gtImikPRPx.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6672
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\59b5dc58bf12459f879db0bae8607091.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6556
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6496
- C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5344
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "dR1lPJXaNP9x" /tr "\"C:\Users\Admin\AppData\Local\dX7tCBYRej2Z\Tm9zuDIdUa0X.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\b0114324ec6f4f35a86421e38bda290c.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5936
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7188
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6068
- C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "jnFYxGh7p3x3" /tr "\"C:\Users\Admin\AppData\Local\KCsJB4pITXz4\uevAh0KgfcmO.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5444
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\faaf7e649604468b8cd80e54f86bf0e1.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4512
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7580
- C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:4224
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "03k7ErzRjJAz" /tr "\"C:\Users\Admin\AppData\Local\VmUXfCohDPDQ\yOuIz20OuzlS.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6732
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7e37f63e92e64127a209df082af03834.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5900
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3716
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7652
- C:\Users\Admin\AppData\Local\Temp\WinLock.exe
  "C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  PID:2444

C:\Users\Admin\AppData\Local\AXNUB3ccHXYz\RD8ZzCUHY5qP.exe
"C:\Users\Admin\AppData\Local\AXNUB3ccHXYz\RD8ZzCUHY5qP.exe"
1⤵
- Executes dropped EXE
PID:5468

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4336

C:\Users\Admin\AppData\Local\Ku7i5eabNtQm\UonmZB5tWXrS.exe
"C:\Users\Admin\AppData\Local\Ku7i5eabNtQm\UonmZB5tWXrS.exe"
1⤵
- Executes dropped EXE
PID:7948

C:\Users\Admin\AppData\Local\lH4duS1l9u6p\RkilW7bAYVWk.exe
"C:\Users\Admin\AppData\Local\lH4duS1l9u6p\RkilW7bAYVWk.exe"
1⤵
- Executes dropped EXE
PID:7988

C:\Users\Admin\AppData\Local\cQIaAAUpNYpc\RaaxZzoi2Ckh.exe
"C:\Users\Admin\AppData\Local\cQIaAAUpNYpc\RaaxZzoi2Ckh.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6456

C:\Users\Admin\AppData\Local\WmMWxcXQVtId\fuJ4m3mAg0I8.exe
"C:\Users\Admin\AppData\Local\WmMWxcXQVtId\fuJ4m3mAg0I8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7228

C:\Users\Admin\AppData\Local\JeucqwatpUnv\kZ9R4SA12s8K.exe
"C:\Users\Admin\AppData\Local\JeucqwatpUnv\kZ9R4SA12s8K.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7608

C:\Users\Admin\AppData\Local\HhC5y5B79dq7\J4IdhV0o1ITb.exe
"C:\Users\Admin\AppData\Local\HhC5y5B79dq7\J4IdhV0o1ITb.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5808

C:\Users\Admin\AppData\Local\Gl63sStvyWsZ\9PUD9sduVauq.exe
"C:\Users\Admin\AppData\Local\Gl63sStvyWsZ\9PUD9sduVauq.exe"
1⤵
- Executes dropped EXE
PID:7520

C:\Users\Admin\AppData\Local\5NiAC5p7ZCKI\ukzvUja36ft8.exe
"C:\Users\Admin\AppData\Local\5NiAC5p7ZCKI\ukzvUja36ft8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5160

C:\Users\Admin\AppData\Local\OPRd2Zh3UOiP\dRHtNNakvB14.exe
"C:\Users\Admin\AppData\Local\OPRd2Zh3UOiP\dRHtNNakvB14.exe"
1⤵
- Executes dropped EXE
PID:7776

C:\Users\Admin\AppData\Local\FXj1kwF3tXL7\UBudMK4OXGbG.exe
"C:\Users\Admin\AppData\Local\FXj1kwF3tXL7\UBudMK4OXGbG.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6672

C:\Users\Admin\AppData\Local\R0ne45hFzmph\XsVZHFra7imN.exe
"C:\Users\Admin\AppData\Local\R0ne45hFzmph\XsVZHFra7imN.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7796

C:\Users\Admin\AppData\Local\BDZTzS0CJ3i6\osCh6DhglNWH.exe
"C:\Users\Admin\AppData\Local\BDZTzS0CJ3i6\osCh6DhglNWH.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6404

C:\Users\Admin\AppData\Local\dX7tCBYRej2Z\Tm9zuDIdUa0X.exe
"C:\Users\Admin\AppData\Local\dX7tCBYRej2Z\Tm9zuDIdUa0X.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6648

C:\Users\Admin\AppData\Local\9vf6rLWxx3xt\q9gtImikPRPx.exe
"C:\Users\Admin\AppData\Local\9vf6rLWxx3xt\q9gtImikPRPx.exe"
1⤵
- Executes dropped EXE
PID:5164

C:\Users\Admin\AppData\Local\gLBik6trAvRN\WDsSwwhi5tyW.exe
"C:\Users\Admin\AppData\Local\gLBik6trAvRN\WDsSwwhi5tyW.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772

C:\Users\Admin\AppData\Local\yta9s8NZ66eS\2xPSvo0Vprg0.exe
"C:\Users\Admin\AppData\Local\yta9s8NZ66eS\2xPSvo0Vprg0.exe"
1⤵
- Executes dropped EXE
PID:7400

C:\Users\Admin\AppData\Local\CGfeJ7LfjVE7\lk09tHpLw3b5.exe
"C:\Users\Admin\AppData\Local\CGfeJ7LfjVE7\lk09tHpLw3b5.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6116

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" /setup
1⤵
- Executes dropped EXE
PID:5820

C:\Users\Admin\AppData\Local\VmUXfCohDPDQ\yOuIz20OuzlS.exe
"C:\Users\Admin\AppData\Local\VmUXfCohDPDQ\yOuIz20OuzlS.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7716

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Executes dropped EXE
PID:6440

C:\Users\Admin\AppData\Local\KCsJB4pITXz4\uevAh0KgfcmO.exe
"C:\Users\Admin\AppData\Local\KCsJB4pITXz4\uevAh0KgfcmO.exe"
1⤵
- Executes dropped EXE
PID:2700

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --init
1⤵
- Executes dropped EXE
PID:3368

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --wininit
1⤵
- Executes dropped EXE
PID:1160

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
- Executes dropped EXE
PID:3404

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:7704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:6212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {38aed7ba-fe4c-4c78-a1fd-8deb79b3a46f} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:3592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2476 -prefsLen 27135 -prefMapHandle 2480 -prefMapSize 270279 -ipcHandle 2488 -initialChannelId {91cd0275-b09a-4ea6-b926-601211a74fbb} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:8092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3536 -prefsLen 27276 -prefMapHandle 3540 -prefMapSize 270279 -jsInitHandle 3544 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3552 -initialChannelId {f1628e7d-eb03-4c5d-a422-aa16c529ce3a} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3696 -prefsLen 27276 -prefMapHandle 3700 -prefMapSize 270279 -ipcHandle 3716 -initialChannelId {729e4638-04d0-4f5a-8daa-c47a59ff1da5} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4616 -prefsLen 34829 -prefMapHandle 4620 -prefMapSize 270279 -jsInitHandle 4624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4628 -initialChannelId {d86da0ed-c090-4d53-8741-42e0c5603d1f} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:4840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5132 -prefsLen 35012 -prefMapHandle 5136 -prefMapSize 270279 -ipcHandle 5148 -initialChannelId {a68ea1d6-88dd-4d51-b8e9-3ad658d4d802} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32900 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {33e287e3-1b8b-48d4-ab09-f7b3b5718c7b} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5808
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {468047b4-5759-4142-8d70-e51e12df241b} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {eb3d936f-b446-4f5f-b929-6d59a241a4fb} -parentPid 968 -crashReporter "\\.\pipe\gecko-crash-server-pipe.968" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2304

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:700
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:6196

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:7716
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:2672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4088
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Antarctida_4ofb6rsmmild.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Antarctida_4ofb6rsmmild.exe.log
Size 1KB
SHA256 c28150812c2fb8b6bc6bf10fe4c08de166f80764513b730a3a56830af774c665
MD5 3835b127b747fe8f12c59ab1e3f1ac55
SHA1 0bac294b8ac254fb70bf8402426756e74a878d77
SHA512 5a80739c158321dee8335cfe9a30b2fefae1a9320e95c5ba2eb5b4bc8dae23031042d20c3f67c998ea07e0f4b2de42cc9422726b731c01057f20a8a5d6c169c8
TLSH
T1E131A1303221B4D44D022F530C18A9C963FF47487A64EF5CB999321EDE2A44BDB311E3
MD5 SHA1 SHA512 TLSH

Submit Download

RaaxZzoi2Ckh.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RaaxZzoi2Ckh.exe.log
Size 42B
SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
MD5 84cfdb4b995b1dbf543b26b86c863adc
SHA1 d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA512 485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
MD5 SHA1 SHA512

Submit Download

4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
Size 16KB
SHA256 2da8c5ceedda706f1b9b6cc08ecf97a101da8132f406916ce28fd378d10f5d55
MD5 5a143a8934838b8ac89e57fac74ead23
SHA1 c96a37d626fb2048f59a793e61e62ba201f2f4c7
SHA512 910426da42ebaa0f9fcd4d214935e6dfe74a94edb2b7638ef8d7bfa1d396f2353bf92374db1c43c0dbe9674f9278be620218c0c555810752b88cfb474eeb2c66
SSDEEP 384:HwCe7iO024YTDL84KKDL849B7SOEAd9KVRaAcP+AWRMAWQ/:QqZYTDL8lKDL8CB7S/AmVAf+hRMjQ/
TLSH
T181729E7D9F413CAC2597C0E8C1F982DA4D18B6A7CFE6806D21683D0DC798969B1F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86DDBDE5E1EAFC4C588EE71FB531985C95CCC542

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\cache2\entries\86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
Size 16KB
SHA256 d7015ae9931e7b8c333bd27a4f676bc3261a273a58448fde86e4998ca578a220
MD5 13f61089db18db11fadced11a2ff05ed
SHA1 8c7a8cbf49cdbe88c184fa593e365d084c17cb4e
SHA512 f25a48a212cfa7ef6320d01bc94782cc66ff3aa4fb23bfd351a801d5af11877577ddac60aa95a69b57af2fc98bbdfb41fac69dfb811550d3e95ea23dda4b9f8f
SSDEEP 384:HXkRyiO024YdDL84KKDL849B7SOEAd9KVRaAcP+AWRMA9:3mZYdDL8lKDL8CB7S/AmVAf+hRMk
TLSH
T1D5728E3D5F003CAC25A780ECC5A982AA4D18B767DFEA80AD21583D0DC698969B5F548F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\jaarrave.default-release\startupCache\webext.sc.lz4
Size 104KB
SHA256 b6758883493ca1639abad6827447b407e32f9f627c226e518254edf1c6b4a78c
MD5 531f26a55e0ae3250bb256e0ce882f7b
SHA1 1487216ae990e8da1a1a15778f43cdd45c03e2ee
SHA512 4cb00e9eaf835e4946d0f60da2acdd0bdf51747453c5bdd1082528c19f24a247cfed193a3f4645a29f3aa5db2011813b8a54e22fdb9755a9795290e65e556ca3
SSDEEP 3072:j3lqn+9RGUrCgVhz3GDPnvRYLJTDk+8R3:pq6RtOgvLGDvMi3
TLSH
T1BBA3AEF6DFA28D7D64FFD42DABC1883EFD262404B3A32109CD63631162C6B786275649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

077c525b1a794b1585d5b2a9b8995286.bat

Path C:\Users\Admin\AppData\Local\Temp\077c525b1a794b1585d5b2a9b8995286.bat
Size 128B
SHA256 6aeeed649bbc1f5bc0fb0635b393d0dd5985eaaa5e9b0408bad9f70eebafb0e8
MD5 95fa13011cbd14ffbd5b34d1e37fc8e4
SHA1 7c0b1c5edf0ddb3138cddae601be13882aaf5003
SHA512 c676946d69d00c97de8d4ad0a7065ee7fb91db89b7144c3853d66c873aa5b8e438546ac65937dba35777e623e4fa388778f48ecb54bf07ed042926538e486f1c
TLSH
T156B02B22209F43CC150100F10ABF2040006FC4C1DD0060820241447E8149032A053CC1
MD5 SHA1 SHA512 TLSH

Submit Download

1c0d4bf68f5840c4abe2646c1cd9a118.bat

Path C:\Users\Admin\AppData\Local\Temp\1c0d4bf68f5840c4abe2646c1cd9a118.bat
Size 128B
SHA256 1ece512c698b571db9ef59cb37418dfc3aba1f5aa1219d8c45eacc78a0bd8220
MD5 e3ab148164e9e60d99a4cf2cf63f84ae
SHA1 d1ac3971d715def6687e1cc821fd6d8ff4e92f2b
SHA512 e0afe80de58acc2ebc77f4376a274ade42de709d3f1bab199be646bbb6f50263604ae2e3d3809f7409b176c42fe3a927713ab0a48394212d17dbcf1c8d2cf7f2
TLSH
T12EB09B16215547DD150110F146BF2545106F94C75A445546555744BE85894365817FC5
MD5 SHA1 SHA512 TLSH

Submit Download

2a10895c04b74bdfb353830950585a9b.bat

Path C:\Users\Admin\AppData\Local\Temp\2a10895c04b74bdfb353830950585a9b.bat
Size 128B
SHA256 9c2defbf10cf766336639602ce33f8e89a35ce81ca8733e00ec3f1e7207c60cd
MD5 41593c220e537b4d3c0a5e0c1e4b9006
SHA1 0e043855538cd4c190554e57ddb3267a42b8abb0
SHA512 c14afef4bac6861dce2cefcc9e79ef38c9572ecc8a23819710b3f1b24b45e80efaa9f905ace04ca7319c25c2ef16d40eabb93f3878336c0b83f6d0b5e6b59022
TLSH
T138B02B1A3255C3CF140610E10AAF2044007EC0C15A00B4460101407E8345036B513CC2
MD5 SHA1 SHA512 TLSH

Submit Download

4e3eabc3f32d40cbbab98a4251332dac.bat

Path C:\Users\Admin\AppData\Local\Temp\4e3eabc3f32d40cbbab98a4251332dac.bat
Size 128B
SHA256 c20d5f60ca0738419c8168d7405cb86015cfff1984f05b4f2282ed73d2e31214
MD5 d085d13878e9ff6236700d79992108bb
SHA1 019c07262346b3db77ef077b5a650968ad3c071a
SHA512 be11c7c5b4948bb1fc660d63be8a9031979e149f555f956d3f052c74828384474ac79060cfe32202e660d54727df51f6203aef34da5ceaf568c77bb1d06fb63b
TLSH
T12BB09B17219987CD184214E34AFF2295507E54C55E0454464555547E864A8765417DC5
MD5 SHA1 SHA512 TLSH

Submit Download

5ab753f24ae94ce1b32e3183ca2ab094.bat

Path C:\Users\Admin\AppData\Local\Temp\5ab753f24ae94ce1b32e3183ca2ab094.bat
Size 128B
SHA256 22ddd152c73e3c7f9998534843c1cd83f4f578ad70ec8d40766e15749df66198
MD5 546fcc96ea08ffb0893a7ed35edab5aa
SHA1 a163909e9bbf0d688e9cc60ed5f0cc7e6e089f1d
SHA512 98a5e867a1996801780136048dbf304d5cff97d0576763864810d636f5500ad035676cf1b5f7ac402abc488923d301a5f2bdabf17e64c2f183dc98a270dfd15b
TLSH
T1C6B09B17615547DD140210B146BF31C5106E50E15904D447575684BED5C54375417DC6
MD5 SHA1 SHA512 TLSH

Submit Download

8XVWPD5L4GWC.zip

Path C:\Users\Admin\AppData\Local\Temp\8XVWPD5L4GWC.zip
Size 2.2MB
SHA256 940ca7e8818d529de5f404938d00c372861a2980b74637279cd4c2e50b891b51
MD5 ffb8387658a5d5b31d17ba051e3e60de
SHA1 cc0343b1f22bbde113da9b7bac84a45da6cc8361
SHA512 cc95febc7c96cd59131798b59c20e9f7357ef8eb2247733b487758ebebf35714938e653979a361c198f7883689b8f3051f76bfc59390dd5a2aa308e506a24bdf
SSDEEP 49152:x5muCmHkv58KcRsN0uxuZG49YSTrub5L8E0AMvQpV39XJrbt3Y:uCkvOKj0pZG4KSPub5L8MMGNVNY
TLSH
T11FB533AD41B3A4ACC188F5F6B768E918C5B33DC924464E62A2004784BDF46FE2F7EC55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92fdc6c9871c498c8eac329799217c8f.bat

Path C:\Users\Admin\AppData\Local\Temp\92fdc6c9871c498c8eac329799217c8f.bat
Size 128B
SHA256 c9c2a72350a732048eb8e23683f168cd341d3a2534325de4414e2c0a761652b3
MD5 2da3870aae89ef4a584b199035c42014
SHA1 cde4b62cf7e47a5dd3fac45f1a4cd0dfb1135fbd
SHA512 1f2a00cad704aab49e5a7d2fcc37ebc56a64a737322edc0ceb19526b00135b92d3bf40887adf0e96d9932df5fd341fc0d4c1a3e3948d5dd3701f53c7abf8008e
TLSH
T1D3B02B12209643CC140620B30BAF2040106E40C15A009042470149BE85C90326023DD2
MD5 SHA1 SHA512 TLSH

Submit Download

WinLock.exe

Path C:\Users\Admin\AppData\Local\Temp\WinLock.exe
Size 240KB
SHA256 547787bf69d6177f08df9d915623613ed30d49c6969d60d571a51dd4c98fd93a
MD5 7c5bbcfa3ae58ba9949be167fd4ea7eb
SHA1 b86c4e18c86c4cfeb45d1a97ac85eb948446170e
SHA512 fb30637faf5cd1d07d6c6937c24ecbfe0828a333dbc13eeb75b2d414ffc01845c23c89e6a85a2a71ec2f88f75ed10a2d4032c4c503fdd6d4bdb807034acbdec4
SSDEEP 6144:tEhfGkH3dZEXuQLL9qAeUaKkg58SCpMW90KImQiXnUbut:y+wdyr9D
TLSH
T1EA346C98136A897DC6BD27BED0A105060BF1B227D103E75CBEECA0E66F27311A741B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_32199d77d47e4cee8baf065a8a43087a\Screenshot.png
Size 406KB
SHA256 7bd63963029abb0448b7a0961515666dd08c662472594a9145f913848fdbdaf9
MD5 3746857b5389898f14d229b0635fb2d2
SHA1 d04c29bef73a737e4ec883c36c0b5fc559acd8d4
SHA512 bdfedf377e55f9897a7a6f5b4f3c9040d031cec28150c217537a26a9702901d13b49c377cc9eff4bf4882d4f7199a0829f36120ff54b021ee61cea456ca1f23e
SSDEEP 12288:6Y/gYu/6ee/BBbivWFI1nIkeh4xgizCQtA1mUkqw5x1Q+HL:6Y/gv6vZBbiz1YkeQG1hJ+HL
TLSH
T14094120D92F2CE6CDCA6267E14E86EA3431BB9A3DA139C5D244AF02EDC44E7A354524D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_333816125a044efd9204a457f683f49a\Screenshot.png
Size 409KB
SHA256 40c7360851c2aba23501c2514f4a7b0583d748302b6cc721e7f65ad7a9ab27ef
MD5 b9a4d8891d71bce727dda39301f689d4
SHA1 43c4f8a33c65ef1e608b958439c947ebaf7cb083
SHA512 f534db6e022b14f4a1239f252dd0117086c05c206cfe8e4dc4a7ad2528c833b5817922f798d7e2b297e6fb35ec268f1c19430d9ee1d9f357739e9ea8f025c144
SSDEEP 6144:+XTtyJrXNeixwA2cQ05rQDAFL1bUrrXBzWXOCyjPdT+/VwbBZnBtKpTzlO/o1k9:PJJsx3sl1gno6BK9wltKOj
TLSH
T1D4941299E0F3CA55EDEF007BADCA1C9C8338D9B38122593E55B0F6959C125BE121239E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Desktop_RegisterRedo.xml

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Desktop_RegisterRedo.xml
Size 545KB
SHA256 8759783d38b409c08959854ae544e72bdc29d365186c91d7f04e3fe08cc1139c
MD5 37bc78cb0934c758827a23c68e298af4
SHA1 139a9fd896ca3e11877509fa264bfb80f65e6345
SHA512 6640c381ca0121b886d63e210ab9257fa3bcf7da824040be8a3133ec4d7626f50010162b638761e7ae624a2782820930a80f8060794a479cc9f4eae1f9563d18
SSDEEP 12288:TzN03w73jtZQLMWwqJR35kMuybww6CkjM2q2YVnjZ3A/hya4:O3y3zQLuq1kObP6Rg4aFA/hT4
TLSH
T1D5C4235AD3B2F50A40049FB2FF9C0B04DF3D5D0914669EA6B610D75C2FB08BA2A37DA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Desktop_ResizeRevoke.docx

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Desktop_ResizeRevoke.docx
Size 19KB
SHA256 3c805a2373eeafe1eb1c475ced971b8944e6153e55b53571e1452a16181a055d
MD5 3545e90386be687c51f54874a24f7219
SHA1 7b1d13e3ae3125d768abc207519f5d3918315e18
SHA512 754e1e82701861ba5c0347966729dd153363323a4c6a7291b9028b6306770bcdf34d5f23250d45d371e285b3e41bd3b6cdc27b1d96cd412c84dedb3f770cd460
SSDEEP 384:aZe0uF3l9mBxS8SUBxs6Zc7u990D+pZ/gEdNxt/ZtNNHbEnzxTIFHBFCN:wuwBxStcs667u4cZhxllNQzFItDW
TLSH
T1CA92B039CE052C51E6624E3CE00B16FAE31A12553746D5E6305FEADF572B7930B0B68E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Desktop_WaitInitialize.ppt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Desktop_WaitInitialize.ppt
Size 190KB
SHA256 ce0969d03d31cb305a351a9ebbd19fcaaaab8b63d246b29f2cbb4081affc136f
MD5 4b5dc6268d53832269acd89e67a80c5d
SHA1 6eb55691debd9166d3d0e5b6f0cae23fbe7bc2bf
SHA512 41af28cad905ff183521d160397ad693d549f35e78d0f1162f11b29f558622203bd229f17a6866365b38c3dfdd0e84eb9c942448be8b5ec7f5fc9d9aed161e94
SSDEEP 3072:O5kHPTDtK2C9NB1dOxDLaZg74c+bdcYdBcxea8/vYoAuONHfVCqoGPWLvrqBK+iW:dYa9aS74jLdBaenY9uONf0qolzF+iLxk
TLSH
T17114122D88A717521ADCF3CC0B3DF8454EB364A6390A51A1D0464F6C36E62F9EBF9139
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Downloads_ImportOpen.rtf

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Downloads_ImportOpen.rtf
Size 210KB
SHA256 ec7d8a5c6d9e6c8428121d2b8b050814f7574387005e223cc89239be583df9ef
MD5 9e49e875d6574c026dce8662881b1201
SHA1 f5de3db4a648a6087dd7a0b872bd0deca719f4f4
SHA512 16d39fd7cfcaeebe6d548ba16308d4deaeb52fd64fd77151a4e33f8cdf2f3f690f16c8d327a942396b881c22d878a83667be7e3190eb01a30964beee19a7dbc9
SSDEEP 6144:3sRK03bKe2WiilTqr6OAaoM6zQeVA75X5VlLQ:FELir6qKEXA
TLSH
T1B524220940E5B8F86FB5A5104A73C864D1F105F6C788B43A9C707FA3EB934E63E96382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Downloads_RedoSkip.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Downloads_RedoSkip.txt
Size 447KB
SHA256 05064cbb232ad9a80a845f1bd8f088e2fb3123a17793051d9d81d2c5adbeee1d
MD5 f54dc0ff9c67e88cce92932bee4e7682
SHA1 5864fff042f6d6c47a678252ac41eed3d2b21a31
SHA512 7a4dbe57d7a401c8b50806e78c5e0f0c7ebc50a58a2ad952150579ee57ed7e45606a8ff115fab01ad8d7bea0607b0166fe89cf06cb5c91fa653cc9f8b049c6f9
SSDEEP 12288:xL+KRjqKmVyiUrzo9bOg7+Tqhbzq0TqW1Ka:YKR2KmwiUrzU7RdzTIa
TLSH
T12DA423E401A66099C7F974CC6760F03C94E73CCAA9B394A29AFB00C35451F6A6FE95C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

C__Users_Admin_Downloads_UnpublishClear.docx

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_3da2410e09b746d3b358b6a70b97d0ac\Grabber\C__Users_Admin_Downloads_UnpublishClear.docx
Size 468KB
SHA256 713917d3eb6b58fbb780355bc5bc46177ad741355ad938a03e4b1e8621d93637
MD5 105cb43213fa2b26a594ef57dd188674
SHA1 009892167af348545bb1b1c55e364a1c75e125fc
SHA512 0e55071dc735488ae7764c7e0cd111d44b1499ca030577f13f8078eb6e75927a6b797572e6a7464d4148d1b7aea9bc767d0c21b1eea6e8f5b51b3daaf91487d3
SSDEEP 12288:++UMCczqc7gpMU3UEjJlLkY4kTRzrqO2lOJgZh:++UMfzqbpMU39jJDhpglgUh
TLSH
T1C3A423F72D63D6B8A352F89BB3A8F68309433AC099574C61426556438CF6B7C077B839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_99a4c5f40da740c291f183e8fd50a4c7\Information.txt
Size 272B
SHA256 1f0f43b6c79fb2930c1ea5083cb63dd24d85aa3334b555bb08813bf32a899e5c
MD5 c86b72be0eb3954d01c3ebdc5f5c3e1e
SHA1 f8e28441ef379c4ef659ea7456e6aa297640cea1
SHA512 2f8899e3e27d52c94fdf9c7333745ab6ff4db4edd5e79511e46ccf99f99a1b9994f13615c1b5ac49835ddcd543df2f4784a90e75e1e5f1347200a31077ef86b1
TLSH
T12BD09570C31D1C0D00E9016B0306331302FFE097119505FC3CDE51F7BD5406155A059D
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_c24dab22bcd94832974e68882e19fcce\Browsers\Firefox\jaarrave.default-release\Bookmarks.txt
Size 111B
SHA256 daac6a48e7ccbc245d710df1fa0eceb380e8a099e3f38e4511e6b7050bd051f7
MD5 d4ab3a0758b53320e7568dc17a29fc51
SHA1 c855b80481d0a26c6e184f41868e93d236a07176
SHA512 5affc783ee55b0ee4b2a01e0a1b27a97277a19a23eb5d58eca3475e6fb0f2e82b23703b7ec3385f7592aab89c83084027b6e4eb74644b4f1192cc395b9a6b08e
TLSH
T1E0B01201D2F114EE5DD41C0A911424406BCFC254138C4B3E84002D50F0AA7FC827D7FC
MD5 SHA1 SHA512 TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_c24dab22bcd94832974e68882e19fcce\Browsers\Firefox\jaarrave.default-release\History.txt
Size 329B
SHA256 b2d2ed58102a2e745b3c6f4f4efcf14d75d7540998cbf5507e8acfe382c06a83
MD5 e8594fd55f81368f6ea1942fa64fa165
SHA1 a0af136530076f14856869b2d49477d23ffa7da1
SHA512 2b8a989da55c0b75c56ccb0c6771c199908b76474552a6288112383de3c4a4f22d5025a5bb1c86d4684d212c78fbf043f661a4ea76111c77e2c80717290bf4ab
TLSH
T15EE07DA3707232681F05CE3570197A5964C3C33ABDE910EFF046383091F87B092F4148
MD5 SHA1 SHA512 TLSH

Submit Download

cert9.db

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_c24dab22bcd94832974e68882e19fcce\Browsers\Firefox\jaarrave.default-release\cert9.db
Size 224KB
SHA256 7fe4a2f15e0582796e2964cede57141389374a3ee1fb022bcfaaa6983014cf1a
MD5 4e19802d3c83e4dcd771f44517162143
SHA1 2323b0978ecbcf19633a4e710e70a07534558024
SHA512 9d5b3bfb0f9afdcaeb972abacc44c183954c3200c3afeadc2691cb5a78662bc5d9a7cb6fbc9b7cfdc8e86e05c91eabf88f7619775160d7477522a1fd40c918b0
SSDEEP 192:jOFva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v:61zkVmvQhyn+Zoz67
TLSH
T16524D086AC04F52ACF4B3430E6834DF37E51520443486A76CABC0E7F1DB520E9B988E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_c24dab22bcd94832974e68882e19fcce\Browsers\Firefox\jaarrave.default-release\prefs.js
Size 6KB
SHA256 4e5d40167d0300cecb6a54b8d916f36eee5fbd585c7920f986ff1eafd232f209
MD5 80ae3e63eb3a751336a78898dd0ed30a
SHA1 73d6014385a0387200334d810fdd1c8309b339c0
SHA512 a831a2168b5811925aad1a8435922edbc20b1f3cf70080303f50009c3c3971d891890a5aaada8c477f7d6abc0a4bd2ec6bcbc5e5965e5474ed59e4fb7e5a9a51
SSDEEP 96:xHBUTUxVqGq5fg9o1zSs9kSSlWdv9j3nqH/8MBw88n8L4cn+wGC:HyR5fg9o5kSS/dBw88hC
TLSH
T184E130789508CB7F74B676ACAC688C715AB2013BB7BF28C710BA5484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_f5992ab5d8c94d46b1f698df91910033\Information.txt
Size 285B
SHA256 56d85dc20b2879f2ddf15e177734ddd74a6d431a556d55aa1da54a7804dfac45
MD5 d8862fdc05ca2b115dfb9f5c6209e74a
SHA1 2a87d99302863c8e5d49843469018f0ba8fcf6ef
SHA512 f7175c23927e931b2ef8c556699962b3256c2ad131e154e943efad657b7c42aef83f4e414d1775bbc5c2c4476a8b6ffd02214d419c9284657b71434d171d5542
TLSH
T160D02B70D31D0C0D41EA116B0306332361FEE08731D50AFC3CCD81E9BC530E19A5569D
MD5 SHA1 SHA512 TLSH

Submit Download

tmp6A10.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A10.tmp
Size 204KB
SHA256 8c24b66b55bef2d89d1ac69204ec3d5d7b191ba051c7c4c4cddcd66d92575d04
MD5 0f709d9a7125f5d69ba52e8846867f41
SHA1 e9e554385d503e88a18665f5fa36d4b8f9d49fb9
SHA512 9969ad8f86e8c40d9d609e65c091565e14ce550d9191c3ea0d1c62ce51d076a79b20078f556667e96f012dffd60578ef82a8cc245676db78d3b6b2b3d9d71711
SSDEEP 96:3XIU+bGz83uy3+u4tgp4DLjGQLBze9z39jBHMsDEuspU0wbtqrOQpPfR4J+MCXki:3Xf+G83uy3Ct7XBBKjH7DXspU3i
TLSH
T176140F0E5F243721CDBD917629E644B35D7CF03F8B5266DA686114B4CEE3A52A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A24.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A24.tmp
Size 224KB
SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
MD5 710df06c7732247ac90a924171429a31
SHA1 74ca20f5987e39ea08d3765803fa25a9638eddea
SHA512 446dcaa944760f53b09f2112d434f8436ccaffcd7e6e270f699068161a7113f9c0b71de8f4e634bdccebb2364c6976c818fae12adb83c006fe1cce421a690c02
SSDEEP 192:f+xj3fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:2B3fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T1DD24640A7B787001EDE3D9725CB080771E3CA16D8F22A6915DB654694EB2853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A28.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A28.tmp
Size 138KB
SHA256 41c1e56b8a6e14cf8598aa737ef094c266e24ece735552787c1a090e86ea620a
MD5 72940f823665602873a9cafb2796a1d7
SHA1 c37dddc1ec66be2a1684e3e64f46e759aa7872e9
SHA512 0c7e2c365c44cbabd62e4f801552939e9bef53a121a833d59e12cb92bb15bf2b623e788fe4b901975593b548b0ff7213e0d29a3c9a00083cd9b1f20065e03591
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OOiRVumGne5:FnbZeMrv/hGtOBne5
TLSH
T137D3A94B3A743002DDE68A722CE051BB5E3C716D8F55A5D528B620588EF2863B23D4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A34.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A34.tmp
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A37.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A37.tmp
Size 20KB
SHA256 de48f5c4308a2477450952a8fd6462c411cc966f9e0fb0065a252b3be831a482
MD5 7696a61462ad640aba1171c8c42f837d
SHA1 4b1efd332c87a107f7b72f71e4b88af6c7994e05
SHA512 4b9849565bdb051e85ce777cc950516fa73b8beb75d54cb794a536176e9c239c5ec46de257c01b028924579d94ef7ddba31872ab244d4c2f999000814437e8a0
SSDEEP 24:TLZLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T9LopFMatSaw/auUOt8B
TLSH
T1F4928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE925ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A39.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A39.tmp
Size 56KB
SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
MD5 f92de240ae86100670164298edba43f2
SHA1 5d9ede7e7743e75344ee7f996456693f82896e5d
SHA512 2e6b9cbd04baf609d91a0583d742b19c5dc6dd7b334349fac1a71563c140075408fe881388e1fff72f5c1c0124d0603d54d35f5039c544ee9c1350b4e1684c21
SSDEEP 96:/kS/KLPeymOoizhGNOnfmG38tmvJHbn8MouB6w9fUPnP:B4oizhGNOnDV77Iw9fK
TLSH
T15E43651F1B682802C8698632BCB194F36F7CA13E8F639E922CB044359D75852B12D5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A45.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A45.tmp
Size 20KB
SHA256 79265a3e366b324e74163601894656ba06514b58574febab32d760296a85fb09
MD5 af51479c33a949e999808f130c17d2db
SHA1 e0e13518cd31fa8ea282c48e36df0bd7e584f58d
SHA512 1e64997cdf39b71a33fc22deecc21b8af09eec3d95532fb362fab8a124f1dc956c3739b28d2e9dc1dff1c8ed4174c9351a73fbf0a203344582028bf8af66a820
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBQNd5d74p8DWr8/fe6jHyj:TeW9aw/aHLopFMavU1iBQNHOpv8nnjHE
TLSH
T1E392CF4F1F343224C4F88776E9D2099B1D7C112C93276BD9EE5418B29D9259FB1060E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A47.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A47.tmp
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A4A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A4A.tmp
Size 288KB
SHA256 ad6778ef80281f2fbdd124bbd25f3f2cf29c48f2b0a084ccdae14d26bce36049
MD5 95b82c178aa4118773cfad1264bba8b4
SHA1 033eb6df25c5589c327aa967b8b603900e44a095
SHA512 10b93b7a64ad9af7256eef07ba3052c1c7380be6bceb84011449c96091eccea8d477076fd2607ec4d19fc3d0a44fbc1c36d02ce5548d78352b233520bed493f4
SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vL9+C4h:f1zkVmvQhyn+Zoz67K9T4h
TLSH
T1C854DC46ED84F40AD70E2430C5854EF23A506B0887815E2FDABC1E7E1EB164DBAAC5C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A5B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A5B.tmp
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp6A5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6A5C.tmp
Size 5.0MB
SHA256 e8266e1ed79774e11828dfa37c03e219d55e05224c2ea4043c492bb0b5482920
MD5 fd34c2b91db97825cf3da91e30b35af4
SHA1 b11ae170b84b72d5ab72fe7ced9798b62602a71c
SHA512 5880a531161cf491bec6c5007a2a850ec516816133642a96b1577d2e269165305e1e7914399b77bdfda0e91c23d7230e65ab84022f559df9b0214fb324079679
SSDEEP 96:D4k1e/wAaF8M9Te9kjQruHtZroSzPFRPRYoa5Af22iV7qIsFw2iwRI7c2xfXsZ8a:M8rJQaXoMXp0VW9FxWHmfsl8Q+K1Zm
TLSH
T1A836011F6A241150C4DAA232ADE35F19183F70168A7776933EA4256E4DE0723B92DCFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 11KB
SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
MD5 25e8156b7f7ca8dad999ee2b93a32b71
SHA1 db587e9e9559b433cee57435cb97a83963659430
SHA512 1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56
SSDEEP 192:96jbMOTaRNUB3K7L7KqRUGcW9KK+DOO4L5h3tCw0RZvjUFV3bXFwo10+H99uhNA:kjbMegNp7L7KCopFDUtCZvjU73zqFiu0
TLSH
T12A32AFAB081F8454EFA710F628B670CFA1BA95B4067C2B1E9B1819855809BD0C5D2EDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 502KB
SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
MD5 e690f995973164fe425f76589b1be2d9
SHA1 e947c4dad203aab37a003194dddc7980c74fa712
SHA512 77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2
SSDEEP 12288:OACaeJXLVL+PLlSuxcewdMCx1uSremBgBohJmiixAzph3yZeErb:OltBL+PLQFZBgBo2xAzpsrb
TLSH
T199B423CCB77B7628D37A9C7BC257D4F853E9CA2B56423CE80C4E018D6540AB136963E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_0f0n0usa9hh9.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe
Size 207KB
SHA256 3a25a60c336fec006fc0606fafa6f8e6bddbbd0ddac20f10f2ff26d0ccc0c323
MD5 80d53aabfdeab6f4173f1727a130f7f2
SHA1 18ab9256df84cd0a59bb286244dfd84c236eb3dc
SHA512 21fed50018bed756b97061a87e63424b179e71882b02624993bb6559c6ee6d14e56013fbf4c6a271c6ee2966a92d777a4d8daa50d81f99e55c79fca2e92aafd0
SSDEEP 6144:RWMNPEyvaRHKIB+nylmV6r0MabLxM03aAa:EMN8yvuluxM0qAa
TLSH
T1ED245D187AC94815E5AFCEB5E4EC60BA89BAE1732442F3431492D0761E527D0FE43DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_36yja3u37vnd.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe
Size 172KB
SHA256 e96411796d9227fd3283ae3024040969c5aa8e75ca74c96b7bd583181c5a29b1
MD5 91d343a51b71dc77bdfae41eaf54a41f
SHA1 a9a86e5279da1bca8c7415fcc71f08967d4c971f
SHA512 1a16672c1ccccfc6cd3770f1ff31aefa97bfa2fcac39ae151692aafcc6d70b5bba70cb3b355a5e669571e32c48ed776c49dbb92b3d151f2621dbe4c2b8246f85
SSDEEP 3072:gtiDQePEyv66TiRL3CY74tbAC/MbiLFzb9ee9R/MjFm6A1nQUb3zwv6oz:kiDNPEyv66TiRTt4JACUbiLdbZ9RkOu
TLSH
T126045D183BC98816E67FC9B4D4F860BA86BDE1732842F74718D6D4A61E127D0F902DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4an4gsa32giq.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe
Size 240KB
SHA256 bdbc3a0f429386053fcf0e5e518b0481965209a50111790be07737911cac6b19
MD5 8742094c50688bddafc951af70a75eeb
SHA1 42b78c7e6db9bf710aee42f2a56f54cc79dabef2
SHA512 3ee3f0c2f03444526cc2475d2ffbea41d532e5573dfe44fe469485cda2dfb52f936f0e6f640c2e694e7e71d5d2a5b33e6d31be4fecadb496960eea235b6f3c81
SSDEEP 6144:8iVNPEyv66TiRTtPqSy+qmaIx+jPbyHRnBAlhDKOT:5VN8yv6ly+ZAURnK/DKOT
TLSH
T167344C197AC94815D96FCAB9D8EC60BF86BDA1736482F3471492E1760E523D0FE02C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4b6yp3in9wwp.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe
Size 227KB
SHA256 e5ffea3134f5126b4195a530e4a28dc0520ed18ef0d00f0e350a281ccab39f0d
MD5 d1d89f83c8e9cf1f0c79a2dad3b75482
SHA1 6412f05c7c945539b9a0f328605eb9806a3933d1
SHA512 9633222190040d6fd7e8cb188062ae4290b334b35628fe1e7f313ef9b8de48890f1d6268fc2819cc383792b453a87ab04184a0d9ca6bff892c3950fdb9b4ecd1
SSDEEP 6144:vWyNPEyvaRHKIB+n2KAnauBy6bYPdpO98JHBQ8:eyN8yvuXKSBAVpO9uH28
TLSH
T17D344B287AC94811D5AF9EB4D8EC60BA89BEE1732442F3475592D0761E127D0FE43CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4ofb6rsmmild.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe
Size 203KB
SHA256 a77fc064d4fe0887420458d603894d789b3feeabf9fc5fc21cd6fbc9c4648634
MD5 f34eb5e829e1035152dbe5cada25174d
SHA1 63c3d3e494e2e2d69814d99d65c570ebb54f0f01
SHA512 44894e4c7faa14ea2b36cb8060eb14c646c8527ec4b08d0892630a81a78ffd57b3058c33d53cf6ee3dc22f18b8d606fc15f5f3b2299f5f5ed3237cb3e727440c
SSDEEP 3072:ptinQePEyv66TiRL3CY7H+L/c0MnDlqQqzIifR8bktwP03lwA1bYatmb3zUv6oz:finNPEyv66TiRTtH+oBDlJqcDbbPwTV
TLSH
T12F146C187AC94815D66FCAB9D8E820BA85BDE1736882F74714D2D0B61E427D0FE43CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_6mz21cxhs1tu.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe
Size 184KB
SHA256 c8093ac5e18312984e2bb979c7a616220aa0af747ea8d8dd0f96d8458b32d98c
MD5 4e7ee04ccddd415902cbb5c391aaa788
SHA1 0120bf5bceff75a3a2642a337daee1f3815f5156
SHA512 452dd4d7855cbe340dc9d9de0741eb6e1d37d1b47f860d8779d66a1c01c2447ccfcaaccca5f67f03d7bc70cd304169f59b71f62795c0a87d217b9ad233050386
SSDEEP 3072:PtitQePEyv66TiRL3CY76eSJtMViDwGwbk0mKWA1Xhcib3zBv6oz:1itNPEyv66TiRTt6eSHMVsebXHZcC
TLSH
T177045C287AC94906E67FCDB5D8E860B989BDE1732842F3531892D0B61E127D0FD42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_bya0g4vx2i0d.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe
Size 177KB
SHA256 a99e493365f8e586d2207b6e2bcf4e1e6dd2a6406cf1d4bc46ddfc389aa30cc7
MD5 6bde6f5cca68f5247787a185c88298ce
SHA1 c44a57467fd966d3b46d6d4fff928c7561daf545
SHA512 7d054b13ccb1b958bf2165af4b4472462271a4faf78a7f2a916e1891912a6254d7881546a20391046c3ba902780cf520fe62bff4771650efd6ff364abba4dca7
SSDEEP 3072:dtiEQePEyv66TiRL3CY7CA7UtaffJobEBpTA3L8wdE5A1iiVb3zDv6oz:jiENPEyv66TiRTtLQcBobSpTAbbJn
TLSH
T1F6046C283AC84D06E66F8D75D4B860BA89BDE1772843F3572897D0B61E527D0ED02CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_d3pdc7owpdt0.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe
Size 207KB
SHA256 423183a9aebd800cc39bb6e7dba1389a6bfa59a37207e04ffd78447da8f2c4e3
MD5 93ce87c8068dcb8bc59643fbfe831114
SHA1 585e1a014130fba41b25e90c6a1277e2d9a54d87
SHA512 0872fd3346b87038d8d46fe4e6f690edb64d121502248242938b33b3ecc6f917b06951de97049fa1ae5a326ebdb48469fe48a4be65564d49ebb01423e899435d
SSDEEP 3072:ktinEQePEyv66TiRL3CY7aLD+92UOvoVwCtCs8Kbau6RoUwA1h7kb3zOv6oz:IinENPEyv66TiRTtaLb5voVwC46bWJF
TLSH
T1B8246C197AC95916D56F8AB8D8EC20BB8AB9E1731882F75314E2D0B61E127D0FD03C77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_dp9hittxyh5a.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe
Size 230KB
SHA256 fd085925ba59d5281333798ce6ab54d5925fa7f007840e26e2c1dfdc5cdca860
MD5 2cf8d7664b982d667a4e326f56e96470
SHA1 7cf3f4c04887e8019ba0137355a396c78f674b4a
SHA512 c4f1ac141c295771a67a3b6b39a37ae2ebc9045001e57af782fb4fee6227b657ae81f8e799832697cc4dd117c62859e934b6f806e42f0d5b5c4939d983c78da8
SSDEEP 6144:ui9NPEyv66TiRTtN/1kOJqYXf5OShbYDuwWtPzg:L9N8yv6stDuwkzg
TLSH
T1C8344B287AC94816D57F8AB5D4EC60BA85BDE1732982F3471992E0760E127D0FE03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_gq1rwsnehpvx.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe
Size 189KB
SHA256 9d5ebd631e9d4353673f6c9905fad5882303280c2d02b2dcb2e8439c55074517
MD5 4197e47d6e3f588aa16f0af89e4f7d2b
SHA1 c3b08930e751fbe095a3136cbac69514f8e5588a
SHA512 52676424f748ff4a3c1368687167cd00d3f09058f25aeb077ea02360cedf26d1d517a4721a217135e0ebff89929c94b996b2c9f936913e4b1aa9c63bc5295fba
SSDEEP 3072:JtiFQePEyv66TiRL3CY79UsglToQF2BfEGgGhHbEkOoSVrA1xSb3zov6oz:/iFNPEyv66TiRTt2sglToQF2B8QHbBOO
TLSH
T1D8145D283BC84915D5AF89B4D8E860BA86B9E1732842F74318D7D0B61E527D0FE43DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_hbdsvcrfkokj.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe
Size 228KB
SHA256 a8a2507a3c6ec04cddc9500a40aba5325ef21a033d6f2c6a531eb2fe3df7e1b6
MD5 ba419328e6d8292c9eec287c2b108cfb
SHA1 3da5822c54eed032022371b567220c0530fb60ff
SHA512 389941c069a04d17a4d5d6c3633b1ce99d65ff7ad95ee3d918da6e7610dfc7b08d795a5e61e6b994ff7bcd17590dc6e97119e644baeff97fc5168520fc8904d4
SSDEEP 6144:ziaNPEyv66TiRTt9L9h3TiAmBVfbX+eUbfNg:maN8yv6lK7+De
TLSH
T1E5344B187AC94816DABFCAB4D4E860BB8ABEE1735446F3471492D0761E127D0FE42C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_hibu6njb1hbs.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe
Size 170KB
SHA256 ad0126922e559411dc0231cfd317eec303348a8067e2f4f78eeb0cfb5695c1bc
MD5 ca5713bb72b624e2f3ac6359c6549f1f
SHA1 8123f133f5f5b40f0e8bf60e7f9b71d94cbd285b
SHA512 fdaedcec4e625c4156c5d6f908781e6bb7cebac630ba88f9d8c23fbfdbf82e692ba8b7419bf91b4e290436e834f106d251fa70540cfbf377c76a82034ded0a1b
SSDEEP 3072:HtiPQePEyv66TiRL3CY7d4t/eHN1BsbIrv2h4bA1UK5b3zSv6oz:NiPNPEyv66TiRTt88NobovbYQ
TLSH
T1F1045B283BC84D16D2AFC974D8B860B986B9E1772942F7532CD3D0A51E127D0EA42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_icmln5soaajv.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe
Size 223KB
SHA256 5addffef6a7f1b6279b64b0d3979dc98f60b7719696608f204ffeff748922fc3
MD5 626ae6a508833d92439ab30e8141446b
SHA1 add936d695e7910f8d14ed97391bab01e8e6f26b
SHA512 1714120a1567b3d4b049691af970713cdb0876388faa6c1324761788c7eee64eece7f13c52b85ba519539c43dda29ecacb55d7049e9483c6fa552eb72b7a4d0e
SSDEEP 6144:pioNPEyv66TiRTtdm+3Poh4L1sSb52jxjb:MoN8yv6XSW1sA0jb
TLSH
T1E9245C187AC94816D96FCEB5D4E860BA85BEE0772582F3471492D1B61E427D0FE03CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_jzu9wque3pea.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe
Size 176KB
SHA256 40bd57bcac2ee4ebada7151f06613b75a0f3a9157aa937424f5de0ab08802b4d
MD5 fbde08e0bdebcdf1dd57b3ffc4dfcbe8
SHA1 f064be6c466cd8fab263ed48ebe427a9305cd598
SHA512 1be8cf9f1e074c736c50292fe1b70b4f3202b2c5ea34a7fff23cf743ba0266a83cd66e8acc6f8961c10a045450839eb0325771ba99a9c2669da54da8ab8e72c0
SSDEEP 3072:fti8QePEyv66TiRL3CY77iaIVZLF48351RFfKZb7L9OM1A1EmOeb3zJv6oz:li8NPEyv66TiRTt7i7VZL2g3Rhcbn9J8
TLSH
T1FB045C283BC84D06D67FC975D4B860B98AB9E2772843F74328D6D0A61E127D0BD42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_n6tli5ilipd4.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe
Size 199KB
SHA256 23d0c89d7cb13d3e1affcbabec988ab8a3c55fc99651196b3e50e3d860a03a57
MD5 2d0d4de998fba63e6140aa62481b8cd5
SHA1 330172cc30a3e71c1040a040d8f8b69947f1eb42
SHA512 71bb1e17a4fe0b344fd24635cee4c5f8f7449a46d2c095965ea866918b04ab3184f63a7c15243d271997c4b0f84b8fbd0b25574b4da4560e6a71ffe1258f3e8d
SSDEEP 6144:5WJNPEyvaRHKIB+n9BqnC8HZGFab//SK:sJN8yvuSQCo8SF
TLSH
T119145C187AC94C06E67F8AB5D4E864BA86B9E0732543F7531892D0B61E127D0FE03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_o2l7d9lw3q3m.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe
Size 239KB
SHA256 f35f10dc72d89beb3fd8220a0870befd9cd3f6541ae00e1494c3dc6a51f75869
MD5 a07206416beb4456bf17af4811197025
SHA1 9e28baab19eccd162a36d7d855983a2192b4172e
SHA512 92ec86f8898ab8e83afd18036edfbfa039b3381a6169e84700391492030087b3c8b06c68a4b746c554331b116470b52356282c67c9b7ff253cba023fc386bbfd
SSDEEP 6144:Wi4NPEyv66TiRTtefAf+xS+f00PDFCbgmscAubQYhfm0CDOp4:D4N8yv6+A8f00PDFCbgmsDYh3Ca+
TLSH
T1B0345C197EC94812E97FCAB5D4EC60AB8ABDA1731482F3471592D0761E527D0FE02CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_qhxavz3ez0bs.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe
Size 175KB
SHA256 4b8ecafbe1f84db871d259d73fa1dd0055228fb3345f085d220f91745baf49f2
MD5 580006723ca7ca65345e4899bac752c6
SHA1 59cbd925e08465bdac3b01343a4d08569ca324ae
SHA512 5bb50214eff7b63933c4167f22ec69566328c8dfa78d6ff954562a67e80fd3b078c31150c84d2adeca8f891e4d706dbe3254a5b0ad333609e0b37f892b90fde7
SSDEEP 3072:WtiGOQePEyv66TiRL3CY7dQwHQsWoGY4GbncvDMypgA19b3zvv6oz:CiGONPEyv66TiRTt7HQfvGbnOgypF
TLSH
T1E4046C283BC98912D27F8DB5D4B860FA86B9E1772842F75718D2D0A61E127D0FD02DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_sppw59vmzljt.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe
Size 211KB
SHA256 3967f801f18324a01933ca03b7d4628c27d297af4a3bdbbd5a51131492a767df
MD5 78f021af3fd8c5deba1166ee8ad1f06a
SHA1 3a98eca462f51ab2b99694d8ed44ac5867e9705a
SHA512 120722a436272257555726ee0adac6bf36ce1d92f7fff1baf7d18f6e96a727561a80cc8aef7151a420679ea6a2016a31d81432ed0654297e0b00e45305045558
SSDEEP 6144:sWANPEyvaRHKIB+nP99GJTtNZbqNh4mqnRBs:xAN8yvu0blN6RBs
TLSH
T1CC245D187AC94912E67FCEB5D9E860BA89B9E1732442F3571492D1B60E127D0FE03C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_wa65fg57rx04.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe
Size 199KB
SHA256 3b2af84654368e72b40738d1850c9ee20885444c3f7bbe0292a62c0583cd1fad
MD5 764bb84e5075de30648b2d9f7e714ea7
SHA1 3a2470e7df50d1077675fabaa82202700410b48d
SHA512 c2e7467001b77f0db72b452611c4c6d55a7155fb0fd71283861fdebbda3a9fe1a091526bbd9a19a98396169a7179970ca5abb5f226243f495457245af389a3dd
SSDEEP 6144:liZMNPEyv66TiRTtOr6ZJ4jhfnKQXYbVSiC7CBgX:gaN8yv6RFQ0SRuBgX
TLSH
T19A146C1C7AC94815D5AFCAB5D4F860BA86BEE1732442F3432492D5A61E523D0FE03DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_yn62z54msax0.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe
Size 237KB
SHA256 03a33474e3662fab79c330da66df99a9186120a766fb4420ad42d64b01eec2df
MD5 8223382ba58f254368530a469745dab1
SHA1 fa790c2d3f8dd8b1468550ea1bbd398add68d72d
SHA512 fe9aee1b492ae49d326d23f548054967a2c1434d5ea3bc052e53c9e54c970547ad1a27b1ca0b91cc46985322c508d57a076df1b9b51547122f83625bc5825014
SSDEEP 6144:0iYNPEyv66TiRTtyHzY3T4SSbERJ0XfiQjt:BYN8yv66zY3T4ok6Qh
TLSH
T1C7344A297AC94812D9AF8EB5D8EC60BA85BEA1731482F3471592D0761F427D0FE03D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 473982b9109a01f98ab89c69119a10db42d1f4b95a3e49d1024c21fdcb7deca4
MD5 397d9d372afec43b20e76ff8f7fcbbd1
SHA1 acf7650843432866f8258cd963f315ef91e70cd6
SHA512 8bd8aafe7c2d8ce30ab4d66dcc4df2dedf1d36f5da1de9bbbd5c23ad31f31319fd7f3f63bc70b1b7c224ab7d48e77e5bab7ca2a6e6db32abc9c5e653f7397349
SSDEEP 192:ZOv5zbowbmlyjQT61d66JozGzgCl6mc0dz:2bowbmlyjfd66JozGzgC1jd
TLSH
T169D12BA4F628863BC409523BCCA50F050F36396B9C4E3F1931DD61082D5B6DE768E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 ea10bd0a478788c739c7540ff832534bfd36afb24d1f8a863f60b2cbb5483b75
MD5 1d45b6fd9ec329dcab40ad7e3342b288
SHA1 8c25d51352d59215e9b03799d91a32279858b258
SHA512 638d8c6a141f400b7f7693a6b2b875dc6bfc0b4c8eb5d214c34b84297b542ff5a406ecd4fb409fcee22c9785490f5e58ed6114b8bd118eb2358d56d5dec4e0d1
SSDEEP 192:uOv5zboPnZmlyjQT61d66JozGzgCl6mc0dz:lbofZmlyjfd66JozGzgC1jd
TLSH
T14FE12BA8F628863BD409127BCCA61F450F39399A9C4E3F1931DC600C2D5B6DE368E17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\db\data.safe.tmp
Size 4KB
SHA256 d0338313dd2fd94f802b2ec0d3ef509911bc6707f61168077d41775fb47768c5
MD5 1b2ccefd4409943795feb856cc79c961
SHA1 7969a537f45ec0e90c919daa9facb251d035a8a8
SHA512 1040790c0d92e2e9d88d643e026684ceb9fbcc1eef8a34d522d26cb944a4c76429d673ac229dd7409b0c01c12e0988a82725230e0daae7ce0db3b6798ce1fa80
SSDEEP 96:HF9QFgbFRFBFe/dd66JozGzgClKtmc0d/UmSdF95/7bkW6arcPh:pc1d66JozGzgCl6mc0dROv5zboSCh
TLSH
T15981DB28F229863FE449423EDCA61B405F347447A86E3F1A31AC644D2E5B3CD7A8D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\events\events
Size 1KB
SHA256 1b5f498cf01225eee006f3f1b2f9013ce8e73c5b482a99b8696fee48d64824ff
MD5 5150dab459f2f059d7cb2ac08f029484
SHA1 05e3eced73a57f50a40d9bd1489c85034593427c
SHA512 5df3093a113143c52b83d66d714859fd2700f4c4b8cba6453d3e4dad2af63884594da9fe590e81b7e2d17c954f19b1be5565cbdd689a8afcfd01c585ce2c12cb
TLSH
T1E911C04C39F94D3AACC7E29C7640028E53518E0A45875D879E12EFCCCED1AD9326AC3C
MD5 SHA1 SHA512 TLSH

Submit Download

83037448-a440-45e9-b849-0fc1f9ce9249

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\83037448-a440-45e9-b849-0fc1f9ce9249
Size 2KB
SHA256 ebab46c42637e2acc5dfbd02cd2e7aad41657e68588ed817fd658da9ef4fdd83
MD5 e62e0b6d1b4d8411fb7ed853f179b98f
SHA1 430e6d8362d86afb34deedc9baa96f41ee8b0054
SHA512 e86774505e75acec7d7580ec2d7ada137ea6b2c23d7dc452d1f06ec4fb2e9c9e847e4c913f4792ba541c91a7c35375228e3326273adf1a7fab86e8bcdb8d8bd3
TLSH
T198410D5875784DB75CEAF1DDD542238E53B48A4350C218432E92EE0C8D967AE336F43A
MD5 SHA1 SHA512 TLSH

Submit Download

98964cc5-5aa3-404d-b142-2ab7a5035fe8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\98964cc5-5aa3-404d-b142-2ab7a5035fe8
Size 16KB
SHA256 b556a64a6687046b1efc235c82334cdfab4af73e7e636c80c92f74a0e30bbf80
MD5 54ecec0e8ea8583fd6235dec8dc48f07
SHA1 9732953a1220f21b05ed852fcfa809214f3ea573
SHA512 51218fc838dfc837be49e40a117264cc76294136b8b5841351d1cfaddaae1268650783d481f704c2d16c4ecfc63a838a0d0a06d878e31037c6d2b8182d47e213
SSDEEP 192:/gmiut6ItmVrUbXfBwR/yPTT8nKSJCGE6B413uMfZyyu26TQsqS+zesRShiRc8:4m3KKScGE6vqu26slS+RRShiRj
TLSH
T13472C856686045BA8251E768D4F87FC3E6F528CF4C41CFCACBE4BE0859DA0AE1127D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6a3f98c-b700-4ad2-9531-a3bd9abdfcc5

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\a6a3f98c-b700-4ad2-9531-a3bd9abdfcc5
Size 883B
SHA256 08905b670d2b2b441cddce07bb9e5d00f20769381ff072937a8924ce0d360131
MD5 d506eb0fadd1dce300514e51bc29699f
SHA1 be8730dc6c3182da966b5a7f613d5ce9741f6d8f
SHA512 fa838355da990f7f71fbbe8bc0e3a94cf8c82c0fd3af8bfd76b546f9203e0d6ae324d12658846f7b915c453ebe47773061ed64e7b6094aec84d8752ddf7061ad
TLSH
T128110082A635B5B7AC68D25B8A55370647F8692380C585183DA15A290C7EA1F932B20B
MD5 SHA1 SHA512 TLSH

Submit Download

c7ce1e63-c39b-492d-96c3-93c7330743fa

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\c7ce1e63-c39b-492d-96c3-93c7330743fa
Size 886B
SHA256 1f090ee33032aabbaf7aee534d2d2967d0fff92b2fae29833319973011a93cfc
MD5 8b419c762f153f4266c77fd8897d4a16
SHA1 f54754ceabd281fd0f0d528e610062826bd12bf8
SHA512 5f053c445f26631b01bffc4901855c4d6de616d131fa9a334c8540123cdc6dddc3af3695c124487c91d367cba350fdbda0d9100ed84600a961469b2ac363cf68
TLSH
T108116381A374B6729CB8E29FD8A5370683E07A2380C94D087E90971C0DFA51E636B307
MD5 SHA1 SHA512 TLSH

Submit Download

e5ee91d1-2800-4caf-8b0a-19a985ea9670

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\e5ee91d1-2800-4caf-8b0a-19a985ea9670
Size 235B
SHA256 979e0ce24b88a6c8ce6f38108e6de0851ed15030d0eee639d67cf5ccbbada445
MD5 5b46d4cabf71a2c3a36a344a9950dda9
SHA1 2d1631cb86a2aae3b41320a405e5cd725937c2b1
SHA512 941379d12eaae11366049f9d4ad7e27e5e39965469e41e787d908b130a3ea402aeda2a99225f668537ed5b3e5d2d75402ee5c0b28f74b963073b32b9c78c3bb5
TLSH
T174D0978018B86BBC08240F06F0B06EC73944CC331960E830C99040B499B89E4429181B
MD5 SHA1 SHA512 TLSH

Submit Download

e86a93c0-45f7-4ae1-abc5-b98f8a9eac55

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\datareporting\glean\pending_pings\e86a93c0-45f7-4ae1-abc5-b98f8a9eac55
Size 235B
SHA256 c0e52c255fce7ccab7820bbc93d6eb390015ae2b4aab61710751906ed1037f80
MD5 93206200c809ac7e1bd53c8fc86c32ce
SHA1 c7a0682bb1b490395243234fc962a18b8445dad8
SHA512 f965381878295129290735c2ef99bc71939807b5bed43437da86cdadfa05bb8d71a5786bf5c43d9c04547e485ad25284ea26e6b8d69dd6b12ba5c0e398c2ce95
TLSH
T1DDD09794B888633D88148F0BF0A078CA30484C3B64B05820A6918134CAFC9C4512184A
MD5 SHA1 SHA512 TLSH

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\extensions.json
Size 16KB
SHA256 8d1a4b8441e2dd0e0b908bc6ada5dc35a7ff3e3c2d0da3e03754b54446b7df47
MD5 d4f469f17fc1b84012b902f57bafeb3e
SHA1 c990dfe94b4732ccb6b95fa9ad49f236672213a0
SHA512 9b1838af2d25dc7806be929fd195a78c97edef4262af8190d1ed55c84418f4aaec2ba21e51259b4fa65c622f9c1ce24a9c9ee25ac9f33c80066a5f014139fc94
SSDEEP 384:okI4v2UmldvV8dhWk94zH96oLL4HkL4PRL4HgL4HuL4HIv4he:/I4+RfmXt4Z644e4R4i404+44
TLSH
T10372521545049EB8294FA78BAA367E02C37D573B70845C78F4DD8FC802FA5B902BB65B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
Size 1.1MB
SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
MD5 626073e8dcf656ac4130e3283c51cbba
SHA1 7e3197e5792e34a67bfef9727ce1dd7dc151284c
SHA512 eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339
SSDEEP 24576:qSPda8zU7qNBLR+R1Uq6S/gCfTuP4PIKth58yS0fDrx1:xfeqNBR+cq6S+4QKtkyS0fv
TLSH
T159458D0AF2A641F8D41ED470966EA722FA79344C173568EF169587202F77BC0AB3EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
Size 116B
SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
MD5 ae29912407dfadf0d683982d4fb57293
SHA1 0542053f5a6ce07dc206f69230109be4a5e25775
SHA512 6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d
TLSH
T101B092446843B0B1187682471D795AA55A79B782E022486D6E6F27E10784727476D4E4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\manifest.json
Size 1002B
SHA256 2894996540fabbd346ed4ced8386ca77d6badf60372e307ee15c906c30340d0d
MD5 dcffff15fa618a53834ee4ae8673bd23
SHA1 87316c1f583f438b55e3b0a94783ff9dc8f177f7
SHA512 250c869c49c886306aa0362567cb1ccacae676f886a5b9206ce77fb92acf3af16bd574e80d01e0f97f031d6f00710af8f82c176df51994dcfb51153bed3cee46
TLSH
T139115B00DD388DD326D4BAA21CD6580A97661DAF5CC23E94379E161D8F1C8AB937376C
MD5 SHA1 SHA512 TLSH

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\gmp-widevinecdm\4.10.3050.0\widevinecdm.dll
Size 21.6MB
SHA256 f1216e26ee8c27f938d7722427d29f190e569ed83d0ba16ea872cae684b97602
MD5 d14dd3f0107ff91c3e21f301d83f82b0
SHA1 f61d7d687c9d4b3b6a6c9c0f5610025b5d3f4e45
SHA512 de745c2ff8440d72c5616a88fc56918f4aa7de202c8c4cd7fd026d5eebebde6ee97a3a8a76f331da4c03042b7d87ba8dc2eda40bb475fb47e56df5c2795cf97d
SSDEEP 393216:bYXajn9L4mghF5QDwW0LmruPCB78HYUUZBKvq9PW1gL2hoHH:emghF5QDwWCm/2YU8Ivq9u5K
TLSH
T14E37F18AF36350A8D84E9DF0426EAA72D0743C4E03359AEF17D47B315A727C06A79F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 8KB
SHA256 6dc7305dea3d7ecbe521c0b88fb2ac0052fc60e7531b24e401396eaa61c5c94a
MD5 958d60d840cd99ff7ba358d08e08581a
SHA1 2cc1ca240fbeebf519ac02e54d3d8c682f59d0d4
SHA512 842defef25c57f034feb180ddbf5a4a2ae78060f5a854f78a362160dc2912a97ffc5ead8e5a1c712a71f90baf76cc183ffd4a6173b114d5bd75cb6489c592d6d
SSDEEP 96:xHBFTUxVqGq5fMfSObzSaCSSlWdv9jsnqWR+r8j4Bw88R8L4cn+wGC:HHR5fMfSpSSdRWBw88LC
TLSH
T1D0021D389444CB7F74B6766CAC6889305AB2063BB6BF68C710A954C4051CF7841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs-1.js
Size 6KB
SHA256 60c818fa69b80dc483a7aaf1cfbc15b26aa9a0989d975b2e5816a67375408813
MD5 9e01d0303f23ebc899bf0a7660972fa3
SHA1 5d25dfb2b92bc1582530a85be4f799e7efd3b2e1
SHA512 131a3631af73a2efbf2d6f65b13258ed1742dee572cd0823ce042d741f8bfcee5dbb8e07ad24f8845f7e9eb52441e6cc96b544b6e22b4dda5c90e3d6d229fdfa
SSDEEP 96:xHBUTUxVqGq5fgfS1zSaCSSlWdv9jsnqH/8MBw88n8L4cn+wGC:HyR5fgfSeSSYdBw88hC
TLSH
T130E120789408CB7F74B676ACAC688D315AB2413BB7BF68C710B65484051CF3442F9AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 6KB
SHA256 cd670c70f00be98db65b8840fe4b1da08031c13f0c8e68ee761e3a60693e5996
MD5 c1174fdaf3a9d85cc6969dfa9a227c73
SHA1 a02ab3c3872d0a41079c44866efad210f152596e
SHA512 338faa67bf5957483e4da6b56dd26e374b2487b7a9156a54fe4e0dad36df08c632fa80759faed23daa085de78bdb686b024e24145afd5582ceabb189a1097cf1
SSDEEP 96:xHBUTUxVqGq5fg9o1zSaCSSlWdv9j3nqH/8MBw88n8L4cn+wGC:HyR5fg9oeSS/dBw88hC
TLSH
T1A4E120789508CB7F74B676ACAC688C715AB2413BB7BF68C710B65484051CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\prefs.js
Size 7KB
SHA256 dd014480a17474c5bbe1a67a26cc3ce7171470d606723dfb71372d1c865e07a0
MD5 1279f0963b2c4f42c5730478459ae95a
SHA1 916b773393da705ef70331e23c7584a7e3365143
SHA512 b7fba5d7b66e49a93cbf4fb8b6fddab82bc414c4d7f694b61d25330d4b656c95e8071c4093b7db71a9546c046b01edd2c6573ea3d3d7e4bc7e910e2f548ef06c
SSDEEP 96:xHBFTUxVqGq5fgfSObzSaCSSlWdv9jsnqH/8MBw88B8L4cn+wGC:HHR5fgfSpSSYdBw887C
TLSH
T18CF11F785044CB7F74B6767CAC6889315AB2413BB7BF68C610B954C4051CF7841FAAEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\jaarrave.default-release\sessionstore-backups\recovery.baklz4
Size 1KB
SHA256 48ada384ecb6ec7dd3dd160f3c7aa03881ea3576782aef79a289a244009e684b
MD5 8822c5a723d2d5aa81f145e610833aa5
SHA1 8aa48e5ba95b9bd2cffa59bb3747ae290957a2cc
SHA512 bfb51a81d5a1bd02be82e8ea58b928c84f676890e27fc6adaeca1947ac3a1668fd77fa2725d33ad9264603a4dd605ab8d3dd02f1f945ebf3ff79acc992e8dc9e
TLSH
T16721CA83896F1EF56E715169D48D4BF2DB88B43184A964E05199988572CA14D32C7129
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-396-0x00000000008C0000-0x00000000008FE000-memory.dmp

Download

memory/1284-470-0x0000000000D00000-0x0000000000D30000-memory.dmp

Download

memory/2144-74-0x0000000000480000-0x00000000004BA000-memory.dmp

Download

memory/2168-101-0x0000000000750000-0x0000000000780000-memory.dmp

Download

memory/2444-1278-0x0000000000940000-0x0000000000982000-memory.dmp

Download

memory/2704-125-0x0000000000BE0000-0x0000000000C1A000-memory.dmp

Download

memory/2868-71-0x0000000000770000-0x00000000007B2000-memory.dmp

Download

memory/3116-151-0x00000000004C0000-0x00000000004FE000-memory.dmp

Download

memory/4168-161-0x0000000005CE0000-0x0000000005D30000-memory.dmp

Download

memory/4168-75-0x0000000000C40000-0x0000000000C78000-memory.dmp

Download

memory/4224-1206-0x0000000000B20000-0x0000000000B60000-memory.dmp

Download

memory/4524-0-0x00000000006B0000-0x00000000008C8000-memory.dmp

Download

memory/4524-1-0x000000001B710000-0x000000001B720000-memory.dmp

Download

memory/4584-1350-0x0000000006480000-0x0000000006A24000-memory.dmp

Download

memory/4584-1321-0x0000000005E30000-0x0000000005EC2000-memory.dmp

Download

memory/4584-477-0x0000000000930000-0x000000000096E000-memory.dmp

Download

memory/4584-1420-0x0000000006AA0000-0x0000000006B06000-memory.dmp

Download

memory/4664-93-0x0000000000980000-0x00000000009B2000-memory.dmp

Download

memory/4900-163-0x0000000000CF0000-0x0000000000D24000-memory.dmp

Download

memory/4940-73-0x0000000000A20000-0x0000000000A54000-memory.dmp

Download

memory/5088-134-0x00000000051A0000-0x00000000051AA000-memory.dmp

Download

memory/5088-135-0x00000000051D0000-0x00000000051E2000-memory.dmp

Download

memory/5088-72-0x00000000009E0000-0x0000000000A1E000-memory.dmp

Download

memory/5344-1043-0x0000000000470000-0x00000000004AA000-memory.dmp

Download

memory/5852-880-0x0000000000E30000-0x0000000000E72000-memory.dmp

Download

memory/5968-1140-0x00000000009E0000-0x0000000000A18000-memory.dmp

Download

memory/5980-703-0x0000000000640000-0x0000000000672000-memory.dmp

Download

memory/6592-819-0x0000000000200000-0x0000000000238000-memory.dmp

Download

memory/7084-962-0x00000000006C0000-0x00000000006F2000-memory.dmp

Download