antarctida_stealer | 54154a472cf64c171cbd93d6e07d32c1b5115512d028734e711955a02a65b4c0

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\Control Panel\International\Geo\Nation	plikan.exe

Executes dropped EXE 43 IoCs

pid	Process
4408	Antarctida_0f0n0usa9hh9.exe
1696	Antarctida_4an4gsa32giq.exe
4680	Antarctida_4b6yp3in9wwp.exe
3652	Antarctida_4ofb6rsmmild.exe
2768	Antarctida_6mz21cxhs1tu.exe
4940	Antarctida_36yja3u37vnd.exe
564	Antarctida_bya0g4vx2i0d.exe
2448	Antarctida_d3pdc7owpdt0.exe
992	Antarctida_dp9hittxyh5a.exe
4908	Antarctida_gq1rwsnehpvx.exe
4072	Antarctida_hbdsvcrfkokj.exe
3756	Antarctida_hibu6njb1hbs.exe
2300	Antarctida_icmln5soaajv.exe
4796	Antarctida_jzu9wque3pea.exe
560	Antarctida_n6tli5ilipd4.exe
5912	Antarctida_o2l7d9lw3q3m.exe
5376	Antarctida_qhxavz3ez0bs.exe
6272	Antarctida_sppw59vmzljt.exe
6536	Antarctida_wa65fg57rx04.exe
6848	Antarctida_yn62z54msax0.exe
7128	WinLock.exe
5044	IIXquKSv6RVe.exe
5184	wmNkY2Lv3M4b.exe
6232	SVhNQzGnzM6r.exe
6408	HEyGct3ziAQn.exe
6244	yaXfnletPLTx.exe
6168	YHCAP60JyCTk.exe
6744	WinLock.exe
4628	dQ0NpYH8ktrA.exe
5836	Q6TX6eTCZaBk.exe
5356	XYlEWproal25.exe
6928	ML3j4RGsTBPA.exe
3696	oJ0XXOSZNo6d.exe
6360	x4TC9fM9UwLh.exe
3876	MNy9QPo7NX6M.exe
6604	Qg8MiNKJbkwl.exe
5420	1I7zNyNw1KpJ.exe
6196	Xi3DqgjNiWkz.exe
3788	U1hESJCQliTX.exe
5852	fst7j2o21afc.exe
5360	AcxFoSMcQV6m.exe
4528	zFQ9ec1OeGQE.exe
5364	WinLock.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eLNYxKYKKByd = "\"C:\\Users\\Admin\\AppData\\Local\\KtaY0dMLt4Cy\\fst7j2o21afc.exe\""	Antarctida_jzu9wque3pea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fM8iSFODdMKm = "\"C:\\Users\\Admin\\AppData\\Local\\SDc0dAkYTxlJ\\SVhNQzGnzM6r.exe\""	Antarctida_sppw59vmzljt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f6IvsXQmZoiF = "\"C:\\Users\\Admin\\AppData\\Local\\TCFoAcVHUsE3\\AcxFoSMcQV6m.exe\""	Antarctida_wa65fg57rx04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ihtyu14KaIr7 = "\"C:\\Users\\Admin\\AppData\\Local\\CEy6VbOFMXdh\\IIXquKSv6RVe.exe\""	Antarctida_d3pdc7owpdt0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eSDSHPRl24v1 = "\"C:\\Users\\Admin\\AppData\\Local\\etGExBxIQQms\\Q6TX6eTCZaBk.exe\""	Antarctida_4an4gsa32giq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\A9nhaCxKqPe1 = "\"C:\\Users\\Admin\\AppData\\Local\\HKIargHXYryy\\U1hESJCQliTX.exe\""	Antarctida_qhxavz3ez0bs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Q03gBKoclhTC = "\"C:\\Users\\Admin\\AppData\\Local\\shkUEg0xZh4J\\wmNkY2Lv3M4b.exe\""	Antarctida_0f0n0usa9hh9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ns2822YsFE4A = "\"C:\\Users\\Admin\\AppData\\Local\\j7IgZ17lvDsJ\\Qg8MiNKJbkwl.exe\""	Antarctida_hbdsvcrfkokj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uKvyXg0eDpSF = "\"C:\\Users\\Admin\\AppData\\Local\\UJJxiknj2ODp\\x4TC9fM9UwLh.exe\""	Antarctida_dp9hittxyh5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\r3rdPD8u06Mv = "\"C:\\Users\\Admin\\AppData\\Local\\xDRsvv8BJgiJ\\ML3j4RGsTBPA.exe\""	Antarctida_4b6yp3in9wwp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zfXuyDeggyw9 = "\"C:\\Users\\Admin\\AppData\\Local\\ZO86y7JyKIGJ\\oJ0XXOSZNo6d.exe\""	Antarctida_6mz21cxhs1tu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yn40ZXhVnadp = "\"C:\\Users\\Admin\\AppData\\Local\\8wqozwTEaOuk\\YHCAP60JyCTk.exe\""	Antarctida_36yja3u37vnd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fxIyKxVKzHBT = "\"C:\\Users\\Admin\\AppData\\Local\\e8W0ogUmLXUl\\Xi3DqgjNiWkz.exe\""	Antarctida_icmln5soaajv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KTCyGkwJcMcm = "\"C:\\Users\\Admin\\AppData\\Local\\xI9A1ImAyF5Q\\yaXfnletPLTx.exe\""	Antarctida_gq1rwsnehpvx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\H6qVnA2raXNZ = "\"C:\\Users\\Admin\\AppData\\Local\\JMNdmS1Gy9kx\\1I7zNyNw1KpJ.exe\""	Antarctida_n6tli5ilipd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UgD3BQd01y7u = "\"C:\\Users\\Admin\\AppData\\Local\\RKN40R2HN9Au\\zFQ9ec1OeGQE.exe\""	Antarctida_o2l7d9lw3q3m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhSfBVC5QVmr = "\"C:\\Users\\Admin\\AppData\\Local\\DtXOUbf24O1R\\XYlEWproal25.exe\""	Antarctida_hibu6njb1hbs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5VPwPJQhMNL = "\"C:\\Users\\Admin\\AppData\\Local\\PNElbHRTZFv2\\HEyGct3ziAQn.exe\""	Antarctida_yn62z54msax0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VsDQVIAXabXu = "\"C:\\Users\\Admin\\AppData\\Local\\nMQmT0zzHcpa\\dQ0NpYH8ktrA.exe\""	Antarctida_bya0g4vx2i0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1741132852-2793423776-1557670484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qKDt4Rx9ZtTa = "\"C:\\Users\\Admin\\AppData\\Local\\CK7eJ7yTvIcH\\MNy9QPo7NX6M.exe\""	Antarctida_4ofb6rsmmild.exe

Looks up external IP address via web service 1 TTPs 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

persistence privilege_escalation

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
20	api.ipify.org
23	api.ipify.org
25	api.ipify.org
83	api.ipify.org
99	api.ipify.org
8	api.ipify.org
11	api.ipify.org
12	api.ipify.org
17	api.ipify.org
22	api.ipify.org
24	api.ipify.org
80	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5076	cmd.exe
3372	cmd.exe
1628	cmd.exe
2664	cmd.exe
5240	cmd.exe
6832	cmd.exe
5200	cmd.exe
796	cmd.exe
532	cmd.exe
1920	cmd.exe
1652	cmd.exe
2744	cmd.exe
7084	cmd.exe
384	cmd.exe
4368	cmd.exe
4728	cmd.exe
3636	cmd.exe
5708	cmd.exe
6448	cmd.exe
4788	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_4an4gsa32giq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_bya0g4vx2i0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zFQ9ec1OeGQE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_36yja3u37vnd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XYlEWproal25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dQ0NpYH8ktrA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	U1hESJCQliTX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_d3pdc7owpdt0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_hibu6njb1hbs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_sppw59vmzljt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YHCAP60JyCTk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MNy9QPo7NX6M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcxFoSMcQV6m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_n6tli5ilipd4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_4b6yp3in9wwp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qg8MiNKJbkwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_6mz21cxhs1tu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmNkY2Lv3M4b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ML3j4RGsTBPA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 20 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
5564	netsh.exe
5436	netsh.exe
5904	netsh.exe
5672	netsh.exe
2580	netsh.exe
6920	netsh.exe
5880	netsh.exe
5664	netsh.exe
5424	netsh.exe
5316	netsh.exe
5636	netsh.exe
5956	netsh.exe
7012	netsh.exe
1796	netsh.exe
5812	netsh.exe
5728	netsh.exe
5656	netsh.exe
3400	netsh.exe
6856	netsh.exe
5920	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 20 IoCs

defense_evasion

pid	Process
3324	timeout.exe
5660	timeout.exe
5668	timeout.exe
4464	timeout.exe
6224	timeout.exe
5656	timeout.exe
5664	timeout.exe
5692	timeout.exe
5828	timeout.exe
5900	timeout.exe
2040	timeout.exe
5416	timeout.exe
4244	timeout.exe
6672	timeout.exe
6940	timeout.exe
5320	timeout.exe
4352	timeout.exe
1328	timeout.exe
6824	timeout.exe
828	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307720806434645"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{EB2C3DB7-8672-466C-B567-5EF2DFA857F5}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
460	schtasks.exe
884	schtasks.exe
5360	schtasks.exe
5688	schtasks.exe
4664	schtasks.exe
7060	schtasks.exe
984	schtasks.exe
4108	schtasks.exe
2340	schtasks.exe
2776	schtasks.exe
2792	schtasks.exe
3080	schtasks.exe
2028	schtasks.exe
5184	schtasks.exe
2060	schtasks.exe
3712	schtasks.exe
4896	schtasks.exe
6820	schtasks.exe
6436	schtasks.exe
1532	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1044	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
388	plikan.exe
992	Antarctida_dp9hittxyh5a.exe
992	Antarctida_dp9hittxyh5a.exe
4072	Antarctida_hbdsvcrfkokj.exe
4072	Antarctida_hbdsvcrfkokj.exe
3756	Antarctida_hibu6njb1hbs.exe
3756	Antarctida_hibu6njb1hbs.exe
564	Antarctida_bya0g4vx2i0d.exe
564	Antarctida_bya0g4vx2i0d.exe
992	Antarctida_dp9hittxyh5a.exe
4072	Antarctida_hbdsvcrfkokj.exe
3756	Antarctida_hibu6njb1hbs.exe
564	Antarctida_bya0g4vx2i0d.exe
2448	Antarctida_d3pdc7owpdt0.exe
2448	Antarctida_d3pdc7owpdt0.exe
3652	Antarctida_4ofb6rsmmild.exe
3652	Antarctida_4ofb6rsmmild.exe
2448	Antarctida_d3pdc7owpdt0.exe
3652	Antarctida_4ofb6rsmmild.exe
4680	Antarctida_4b6yp3in9wwp.exe
4680	Antarctida_4b6yp3in9wwp.exe
4680	Antarctida_4b6yp3in9wwp.exe
2768	Antarctida_6mz21cxhs1tu.exe
2768	Antarctida_6mz21cxhs1tu.exe
4940	Antarctida_36yja3u37vnd.exe
4940	Antarctida_36yja3u37vnd.exe
2768	Antarctida_6mz21cxhs1tu.exe
2768	Antarctida_6mz21cxhs1tu.exe
1696	Antarctida_4an4gsa32giq.exe
1696	Antarctida_4an4gsa32giq.exe
4940	Antarctida_36yja3u37vnd.exe
4940	Antarctida_36yja3u37vnd.exe
4908	Antarctida_gq1rwsnehpvx.exe
4908	Antarctida_gq1rwsnehpvx.exe
1696	Antarctida_4an4gsa32giq.exe
2300	Antarctida_icmln5soaajv.exe
2300	Antarctida_icmln5soaajv.exe
4908	Antarctida_gq1rwsnehpvx.exe
2300	Antarctida_icmln5soaajv.exe
4408	Antarctida_0f0n0usa9hh9.exe
4408	Antarctida_0f0n0usa9hh9.exe
4796	Antarctida_jzu9wque3pea.exe
4796	Antarctida_jzu9wque3pea.exe
4408	Antarctida_0f0n0usa9hh9.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1044	vlc.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	388	plikan.exe
Token: SeDebugPrivilege	4408	Antarctida_0f0n0usa9hh9.exe
Token: SeDebugPrivilege	4072	Antarctida_hbdsvcrfkokj.exe
Token: SeDebugPrivilege	4940	Antarctida_36yja3u37vnd.exe
Token: SeDebugPrivilege	4908	Antarctida_gq1rwsnehpvx.exe
Token: SeDebugPrivilege	3756	Antarctida_hibu6njb1hbs.exe
Token: SeDebugPrivilege	564	Antarctida_bya0g4vx2i0d.exe
Token: SeDebugPrivilege	4680	Antarctida_4b6yp3in9wwp.exe
Token: SeDebugPrivilege	2768	Antarctida_6mz21cxhs1tu.exe
Token: SeDebugPrivilege	1696	Antarctida_4an4gsa32giq.exe
Token: SeDebugPrivilege	992	Antarctida_dp9hittxyh5a.exe
Token: SeDebugPrivilege	2448	Antarctida_d3pdc7owpdt0.exe
Token: SeDebugPrivilege	2300	Antarctida_icmln5soaajv.exe
Token: SeDebugPrivilege	3652	Antarctida_4ofb6rsmmild.exe
Token: SeDebugPrivilege	4796	Antarctida_jzu9wque3pea.exe
Token: SeDebugPrivilege	560	Antarctida_n6tli5ilipd4.exe
Token: SeDebugPrivilege	5912	Antarctida_o2l7d9lw3q3m.exe
Token: SeDebugPrivilege	5376	Antarctida_qhxavz3ez0bs.exe
Token: SeDebugPrivilege	6272	Antarctida_sppw59vmzljt.exe
Token: SeDebugPrivilege	6536	Antarctida_wa65fg57rx04.exe
Token: SeDebugPrivilege	6848	Antarctida_yn62z54msax0.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
7128	WinLock.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1092	msedge.exe
1092	msedge.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe
1044	vlc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5684	mspaint.exe
5684	mspaint.exe
5684	mspaint.exe
5684	mspaint.exe
1044	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 4408	388	plikan.exe	84
PID 388 wrote to memory of 1696	388	plikan.exe	85
PID 388 wrote to memory of 4680	388	plikan.exe	86
PID 388 wrote to memory of 3652	388	plikan.exe	87
PID 388 wrote to memory of 2768	388	plikan.exe	88
PID 388 wrote to memory of 4940	388	plikan.exe	89
PID 388 wrote to memory of 564	388	plikan.exe	90
PID 388 wrote to memory of 2448	388	plikan.exe	91
PID 388 wrote to memory of 992	388	plikan.exe	92
PID 388 wrote to memory of 4908	388	plikan.exe	93
PID 388 wrote to memory of 4072	388	plikan.exe	94
PID 388 wrote to memory of 3756	388	plikan.exe	95
PID 388 wrote to memory of 2300	388	plikan.exe	96
PID 4408 wrote to memory of 460	4408	Antarctida_0f0n0usa9hh9.exe	98
PID 4072 wrote to memory of 2028	4072	Antarctida_hbdsvcrfkokj.exe	100
PID 564 wrote to memory of 984	564	Antarctida_bya0g4vx2i0d.exe	103
PID 564 wrote to memory of 4728	564	Antarctida_bya0g4vx2i0d.exe	104
PID 4072 wrote to memory of 532	4072	Antarctida_hbdsvcrfkokj.exe	105
PID 992 wrote to memory of 3080	992	Antarctida_dp9hittxyh5a.exe	108
PID 992 wrote to memory of 4368	992	Antarctida_dp9hittxyh5a.exe	109
PID 3756 wrote to memory of 2792	3756	Antarctida_hibu6njb1hbs.exe	113
PID 3756 wrote to memory of 1920	3756	Antarctida_hibu6njb1hbs.exe	114
PID 2448 wrote to memory of 4896	2448	Antarctida_d3pdc7owpdt0.exe	115
PID 2448 wrote to memory of 2664	2448	Antarctida_d3pdc7owpdt0.exe	117
PID 3652 wrote to memory of 2776	3652	Antarctida_4ofb6rsmmild.exe	118
PID 3652 wrote to memory of 1652	3652	Antarctida_4ofb6rsmmild.exe	120
PID 4680 wrote to memory of 3712	4680	Antarctida_4b6yp3in9wwp.exe	125
PID 4680 wrote to memory of 1628	4680	Antarctida_4b6yp3in9wwp.exe	126
PID 4728 wrote to memory of 4352	4728	cmd.exe	127
PID 2768 wrote to memory of 1532	2768	Antarctida_6mz21cxhs1tu.exe	130
PID 2768 wrote to memory of 3372	2768	Antarctida_6mz21cxhs1tu.exe	131
PID 4940 wrote to memory of 884	4940	Antarctida_36yja3u37vnd.exe	132
PID 4908 wrote to memory of 2060	4908	Antarctida_gq1rwsnehpvx.exe	133
PID 4940 wrote to memory of 384	4940	Antarctida_36yja3u37vnd.exe	134
PID 4908 wrote to memory of 796	4908	Antarctida_gq1rwsnehpvx.exe	135
PID 1696 wrote to memory of 4108	1696	Antarctida_4an4gsa32giq.exe	137
PID 1696 wrote to memory of 3636	1696	Antarctida_4an4gsa32giq.exe	139
PID 2300 wrote to memory of 2340	2300	Antarctida_icmln5soaajv.exe	147
PID 2300 wrote to memory of 2744	2300	Antarctida_icmln5soaajv.exe	148
PID 4408 wrote to memory of 4788	4408	Antarctida_0f0n0usa9hh9.exe	101
PID 388 wrote to memory of 4796	388	plikan.exe	97
PID 4796 wrote to memory of 5184	4796	Antarctida_jzu9wque3pea.exe	262
PID 4796 wrote to memory of 5200	4796	Antarctida_jzu9wque3pea.exe	165
PID 388 wrote to memory of 560	388	plikan.exe	163
PID 4072 wrote to memory of 5424	4072	Antarctida_hbdsvcrfkokj.exe	168
PID 2448 wrote to memory of 5436	2448	Antarctida_d3pdc7owpdt0.exe	169
PID 3756 wrote to memory of 5564	3756	Antarctida_hibu6njb1hbs.exe	170
PID 560 wrote to memory of 5688	560	Antarctida_n6tli5ilipd4.exe	176
PID 560 wrote to memory of 5708	560	Antarctida_n6tli5ilipd4.exe	178
PID 2768 wrote to memory of 5656	2768	Antarctida_6mz21cxhs1tu.exe	265
PID 1696 wrote to memory of 5728	1696	Antarctida_4an4gsa32giq.exe	179
PID 4680 wrote to memory of 5812	4680	Antarctida_4b6yp3in9wwp.exe	181
PID 992 wrote to memory of 5636	992	Antarctida_dp9hittxyh5a.exe	171
PID 564 wrote to memory of 5664	564	Antarctida_bya0g4vx2i0d.exe	270
PID 3652 wrote to memory of 5672	3652	Antarctida_4ofb6rsmmild.exe	174
PID 4908 wrote to memory of 5880	4908	Antarctida_gq1rwsnehpvx.exe	186
PID 4940 wrote to memory of 5904	4940	Antarctida_36yja3u37vnd.exe	187
PID 388 wrote to memory of 5912	388	plikan.exe	188
PID 5912 wrote to memory of 5360	5912	Antarctida_o2l7d9lw3q3m.exe	287
PID 5912 wrote to memory of 5240	5912	Antarctida_o2l7d9lw3q3m.exe	200
PID 388 wrote to memory of 5376	388	plikan.exe	201
PID 2300 wrote to memory of 5316	2300	Antarctida_icmln5soaajv.exe	198
PID 4796 wrote to memory of 5920	4796	Antarctida_jzu9wque3pea.exe	204
PID 4408 wrote to memory of 2580	4408	Antarctida_0f0n0usa9hh9.exe	205

C:\Users\Admin\AppData\Local\Temp\plikan.exe
"C:\Users\Admin\AppData\Local\Temp\plikan.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:388
- C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "5x3p1s81m7Lr" /tr "\"C:\Users\Admin\AppData\Local\shkUEg0xZh4J\wmNkY2Lv3M4b.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:460
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\a73717681f914429b5dbe34881055d3a.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4788
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5828
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2580
- C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "N7n0XVtYpLV6" /tr "\"C:\Users\Admin\AppData\Local\etGExBxIQQms\Q6TX6eTCZaBk.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1bade02ad91c4f168e00f34457067086.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3636
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5660
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5728
- C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "u4bzTcHYiELg" /tr "\"C:\Users\Admin\AppData\Local\xDRsvv8BJgiJ\ML3j4RGsTBPA.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3712
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\b2a49c685cba44de87a7926940edcd68.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1628
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6824
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5812
- C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "TpX9CGbJOFDk" /tr "\"C:\Users\Admin\AppData\Local\CK7eJ7yTvIcH\MNy9QPo7NX6M.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\05d0699b250d4372bff55dfe93a5bb5b.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1652
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1328
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5672
- C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "ctayYUNOo2l8" /tr "\"C:\Users\Admin\AppData\Local\ZO86y7JyKIGJ\oJ0XXOSZNo6d.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\99b08165c33f43b0995459d72c5c22f6.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6940
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5656
- C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "EyX4Ss4vBE0w" /tr "\"C:\Users\Admin\AppData\Local\8wqozwTEaOuk\YHCAP60JyCTk.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:884
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\90de1ad2fe184106a92c58da09a89be5.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:384
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:828
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5904
- C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "xXHXt8DvdIYD" /tr "\"C:\Users\Admin\AppData\Local\nMQmT0zzHcpa\dQ0NpYH8ktrA.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:984
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\e97c842d565e4dc49685c09f05663b58.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4352
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5664
- C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "oX411Rxjx0IQ" /tr "\"C:\Users\Admin\AppData\Local\CEy6VbOFMXdh\IIXquKSv6RVe.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4896
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\78f3cdbc5b524679bf74de65d0e57112.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2664
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3324
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5436
- C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "iRs5hBCAJQ5N" /tr "\"C:\Users\Admin\AppData\Local\UJJxiknj2ODp\x4TC9fM9UwLh.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\b0a82158fa7a4cbb8f97baaf192b798c.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4368
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6672
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5636
- C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "ELGwbWyDJqVA" /tr "\"C:\Users\Admin\AppData\Local\xI9A1ImAyF5Q\yaXfnletPLTx.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8cf15681e9ba4734b09a9f6b89f8ce9d.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:796
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6224
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5880
- C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "aqZXHGa0W4c4" /tr "\"C:\Users\Admin\AppData\Local\j7IgZ17lvDsJ\Qg8MiNKJbkwl.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3ce07f78ce0b48e6a581337abf6ab09a.bat"
    3⤵
    - Executes a command shell one-liner
    PID:532
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4244
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5424
- C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "GepkmvBrmmqI" /tr "\"C:\Users\Admin\AppData\Local\DtXOUbf24O1R\XYlEWproal25.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ff0e2d68bc864bee8c5ef823dbb22cda.bat"
    3⤵
    - Executes a command shell one-liner
    PID:1920
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5692
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5564
- C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "jh1GRYNxyi2R" /tr "\"C:\Users\Admin\AppData\Local\e8W0ogUmLXUl\Xi3DqgjNiWkz.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2340
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\93bb4737ffc2445a9579c6d0018a17dc.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2744
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5320
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5316
- C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "gWDvBQtcK9qn" /tr "\"C:\Users\Admin\AppData\Local\KtaY0dMLt4Cy\fst7j2o21afc.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1734bea762fe472ab75d942f2b57d1b8.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5200
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5900
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5920
- C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "01DW649XoKCD" /tr "\"C:\Users\Admin\AppData\Local\JMNdmS1Gy9kx\1I7zNyNw1KpJ.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5688
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1ac52e16ee1f405791b41b3fb5594a70.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5708
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5656
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6856
- C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "S4TRjwdLBpAX" /tr "\"C:\Users\Admin\AppData\Local\RKN40R2HN9Au\zFQ9ec1OeGQE.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5360
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\95b4bb119151457c84cffcd369a09951.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5240
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5668
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:7012
- C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "pwNJJBHis5eF" /tr "\"C:\Users\Admin\AppData\Local\HKIargHXYryy\U1hESJCQliTX.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4664
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\d9017ab753114c55a324729818d0f455.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4464
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3400
- C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6272
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "sOrCmmz1Xy5t" /tr "\"C:\Users\Admin\AppData\Local\SDc0dAkYTxlJ\SVhNQzGnzM6r.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6436
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\486e4fc65b6b4a91af6c91b3b1b783ae.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6448
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5664
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5956
- C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:6536
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "zFa2H26VCX7n" /tr "\"C:\Users\Admin\AppData\Local\TCFoAcVHUsE3\AcxFoSMcQV6m.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6820
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1981ce6a213f40528bec8ea0b6ed2919.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6832
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2040
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6920
- C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:6848
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "ndiiwKuoC12k" /tr "\"C:\Users\Admin\AppData\Local\PNElbHRTZFv2\HEyGct3ziAQn.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7060
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3d0eb51a4e574f568d294e905b1327d8.bat"
    3⤵
    - Executes a command shell one-liner
    PID:7084
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5416
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1796
- C:\Users\Admin\AppData\Local\Temp\WinLock.exe
  "C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of FindShellTrayWindow
  PID:7128

C:\Users\Admin\AppData\Local\CEy6VbOFMXdh\IIXquKSv6RVe.exe
"C:\Users\Admin\AppData\Local\CEy6VbOFMXdh\IIXquKSv6RVe.exe"
1⤵
- Executes dropped EXE
PID:5044

C:\Users\Admin\AppData\Local\shkUEg0xZh4J\wmNkY2Lv3M4b.exe
"C:\Users\Admin\AppData\Local\shkUEg0xZh4J\wmNkY2Lv3M4b.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5184

C:\Users\Admin\AppData\Local\SDc0dAkYTxlJ\SVhNQzGnzM6r.exe
"C:\Users\Admin\AppData\Local\SDc0dAkYTxlJ\SVhNQzGnzM6r.exe"
1⤵
- Executes dropped EXE
PID:6232

C:\Users\Admin\AppData\Local\PNElbHRTZFv2\HEyGct3ziAQn.exe
"C:\Users\Admin\AppData\Local\PNElbHRTZFv2\HEyGct3ziAQn.exe"
1⤵
- Executes dropped EXE
PID:6408

C:\Users\Admin\AppData\Local\xI9A1ImAyF5Q\yaXfnletPLTx.exe
"C:\Users\Admin\AppData\Local\xI9A1ImAyF5Q\yaXfnletPLTx.exe"
1⤵
- Executes dropped EXE
PID:6244

C:\Users\Admin\AppData\Local\8wqozwTEaOuk\YHCAP60JyCTk.exe
"C:\Users\Admin\AppData\Local\8wqozwTEaOuk\YHCAP60JyCTk.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6168

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Executes dropped EXE
PID:6744

C:\Users\Admin\AppData\Local\DtXOUbf24O1R\XYlEWproal25.exe
"C:\Users\Admin\AppData\Local\DtXOUbf24O1R\XYlEWproal25.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5356

C:\Users\Admin\AppData\Local\nMQmT0zzHcpa\dQ0NpYH8ktrA.exe
"C:\Users\Admin\AppData\Local\nMQmT0zzHcpa\dQ0NpYH8ktrA.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628

C:\Users\Admin\AppData\Local\etGExBxIQQms\Q6TX6eTCZaBk.exe
"C:\Users\Admin\AppData\Local\etGExBxIQQms\Q6TX6eTCZaBk.exe"
1⤵
- Executes dropped EXE
PID:5836

C:\Users\Admin\AppData\Local\xDRsvv8BJgiJ\ML3j4RGsTBPA.exe
"C:\Users\Admin\AppData\Local\xDRsvv8BJgiJ\ML3j4RGsTBPA.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6928

C:\Users\Admin\AppData\Local\ZO86y7JyKIGJ\oJ0XXOSZNo6d.exe
"C:\Users\Admin\AppData\Local\ZO86y7JyKIGJ\oJ0XXOSZNo6d.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Users\Admin\AppData\Local\UJJxiknj2ODp\x4TC9fM9UwLh.exe
"C:\Users\Admin\AppData\Local\UJJxiknj2ODp\x4TC9fM9UwLh.exe"
1⤵
- Executes dropped EXE
PID:6360

C:\Users\Admin\AppData\Local\CK7eJ7yTvIcH\MNy9QPo7NX6M.exe
"C:\Users\Admin\AppData\Local\CK7eJ7yTvIcH\MNy9QPo7NX6M.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3876

C:\Users\Admin\AppData\Local\j7IgZ17lvDsJ\Qg8MiNKJbkwl.exe
"C:\Users\Admin\AppData\Local\j7IgZ17lvDsJ\Qg8MiNKJbkwl.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6604

C:\Users\Admin\AppData\Local\JMNdmS1Gy9kx\1I7zNyNw1KpJ.exe
"C:\Users\Admin\AppData\Local\JMNdmS1Gy9kx\1I7zNyNw1KpJ.exe"
1⤵
- Executes dropped EXE
PID:5420

C:\Users\Admin\AppData\Local\HKIargHXYryy\U1hESJCQliTX.exe
"C:\Users\Admin\AppData\Local\HKIargHXYryy\U1hESJCQliTX.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3788

C:\Users\Admin\AppData\Local\e8W0ogUmLXUl\Xi3DqgjNiWkz.exe
"C:\Users\Admin\AppData\Local\e8W0ogUmLXUl\Xi3DqgjNiWkz.exe"
1⤵
- Executes dropped EXE
PID:6196

C:\Users\Admin\AppData\Local\KtaY0dMLt4Cy\fst7j2o21afc.exe
"C:\Users\Admin\AppData\Local\KtaY0dMLt4Cy\fst7j2o21afc.exe"
1⤵
- Executes dropped EXE
PID:5852

C:\Users\Admin\AppData\Local\TCFoAcVHUsE3\AcxFoSMcQV6m.exe
"C:\Users\Admin\AppData\Local\TCFoAcVHUsE3\AcxFoSMcQV6m.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5360

C:\Users\Admin\AppData\Local\RKN40R2HN9Au\zFQ9ec1OeGQE.exe
"C:\Users\Admin\AppData\Local\RKN40R2HN9Au\zFQ9ec1OeGQE.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
- Executes dropped EXE
PID:5364

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SuspendConfirm.gif"
1⤵
- Suspicious use of SetWindowsHookEx
PID:5684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5176

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SplitWrite.asf"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SplitWrite.asf"
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RepairEnable.mht
1⤵
PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument C:\Users\Admin\Desktop\RepairEnable.mht
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x26c,0x7ffd2836c188,0x7ffd2836c194,0x7ffd2836c1a0
    3⤵
    PID:6708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,15659311537661877996,2536564783536695917,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,2543136079716277018,8193900772477493685,262144 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
    3⤵
    PID:2836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,8096975604982097139,8695337337730023071,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,7041738739688250195,8373490113223159473,2097152 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,17198851688028260565,1141319037871415510,2097152 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,12891494576603463416,10419952534858470873,2097152 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,8478265911762540823,12136451993561809265,2097152 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:2
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,15134757560666053847,6866507899282677816,2097152 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,3720064190881762060,10692971304690152782,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:6016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,3550332085142682508,16768350350362066685,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,3310673348531453831,648818312118910638,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:6380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,12423667910006233058,6984070084557644308,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
    3⤵
    PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10524711830312971929,9513550669018759685,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:6252
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,10524711830312971929,9513550669018759685,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6679418832800492775,12994857832052278148,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,436158585247635552,1074283115637182397,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
    3⤵
    PID:4852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,13538238269576271514,2954780392958525974,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,18050336628494109341,6512446714821877589,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
    3⤵
    PID:472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,3387504057402987450,12855024491100055764,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
    3⤵
    PID:6304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,14988834017691792442,7866644163321446466,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
    3⤵
    PID:792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,6387857542475983305,4220655879660235481,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:6808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,769847457055677951,7976597827872873384,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:8
    3⤵
    PID:5352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10838987743853398762,5243572138021346734,524288 --field-trial-handle=2972,i,11134830074266186411,1406006290934483135,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
    3⤵
    PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery