antarctida_stealer | 54154a472cf64c171cbd93d6e07d32c1b5115512d028734e711955a02a65b4c0

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
123s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
plikan.exe
Size 2.1MB
Sample260809-wk361ashkb
SHA256 54154a472cf64c171cbd93d6e07d32c1b5115512d028734e711955a02a65b4c0
MD5 1426589d0fa33f94e2e4a808192705bd
SHA1 fb2d8bdb22e86d5aebb94e142cec4d3336e85696
SHA512 4cc4201997d4b69b0f7936e77d8988b05be671d2736c67b6a96269094eb4d711522dde142f5ce7c329b69ff1d0e398e7eee1f7f75907e62195bfd68d9032e870
SSDEEP 49152:whg+JpBjN+8CId/zhGheUbLx/8fkBE4sCtd1+3d:WRCId/1GhXx/Q34sCw3d
TLSH
T171A533C507A09A65E65B03B02D3CAA63D16F345DF824DF5C258A9207DFB4B718ECE4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution antarctida_stealer persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

antarctida_stealer

https://api.telegram.org/bot7234567890:AAHt4fLkz9wQ8xYp2BnM6vRcJ3sW7aE5dF0g/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8945623101:AAG7rP9sN2bXcVfR5tYhU8jKl3wQ6eZ1oA4/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8567890123:AAF5mN2pQrS7tUvW9xYzA4bC6dE0fG3hJ8/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8790123456:AAG9mN2pQrS5tUvW8xYzA3bC6dE1fG4hJ7/sendMessage?chat_id=7809455858
https://api.telegram.org/bot9012345678:AAH6kLmN4pQrS8tUvW2xYzA5bC9dE0fG3h/sendMessage?chat_id=7809455858
https://api.telegram.org/bot9123456789:AAE5kLmN9pQrS4tUvW6xYzA8bC1dE2fG3hI/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8345678901:AAE2gH7jK5lN9pQrS3tUvW6xYzA8bC1dE4/sendMessage?chat_id=7809455858
https://api.telegram.org/bot8567342901:AAF3gH7jK5lN8pQrS2tUvW4xYzA6bC9dE0f/sendMessage?chat_id=7809455858

Mutex

23AGT69WVTNC3CD5

Attributes

Wifi
true
bot_token
7234567890:AAHt4fLkz9wQ8xYp2BnM6vRcJ3sW7aE5dF0g
browsers
true
chat_id
7809455858
crypto
true
gaming
true
grabber
true
hide
true
hosts
true
mail
true
messengers
true
mutex
23AGT69WVTNC3CD5
netstat
true
process_dump
true
product_key
true
screenshot
true
sockets
true
sys_info
true

Signatures

Family: AntarctidaStealer
AntarctidaStealer is an Windows stealer written in C#.
stealer antarctida_stealer

Executes dropped EXE 43 IoCs

pid	Process
3260	Antarctida_0f0n0usa9hh9.exe
5836	Antarctida_4an4gsa32giq.exe
4304	Antarctida_4b6yp3in9wwp.exe
2128	Antarctida_4ofb6rsmmild.exe
4068	Antarctida_6mz21cxhs1tu.exe
5772	Antarctida_36yja3u37vnd.exe
6004	Antarctida_bya0g4vx2i0d.exe
1200	4j9E7M0A9kDe.exe
560	x5E6E4LVP3q8.exe
4152	7leBeG08WYsT.exe
2144	Antarctida_d3pdc7owpdt0.exe
4344	jDFeGCQR3An2.exe
1360	lNosi2G6CTlR.exe
3452	Antarctida_dp9hittxyh5a.exe
2268	Antarctida_gq1rwsnehpvx.exe
5040	pgmhLMEOnCCK.exe
824	gcRzyLeCd6w9.exe
1988	Antarctida_hbdsvcrfkokj.exe
3792	XbMIAQ9pY4mU.exe
4532	Antarctida_hibu6njb1hbs.exe
6124	YhPTEAMCxFPX.exe
704	fkJoQSjvXIkj.exe
1800	Antarctida_icmln5soaajv.exe
4732	Z6h0ae4Lmnt3.exe
1528	Antarctida_jzu9wque3pea.exe
824	kku0w4oSOqzG.exe
1836	Antarctida_n6tli5ilipd4.exe
3164	aKft9BhrzQ1g.exe
932	Antarctida_o2l7d9lw3q3m.exe
2764	z4GW6T9mz5Tv.exe
3908	Antarctida_qhxavz3ez0bs.exe
4684	Antarctida_sppw59vmzljt.exe
5116	r7i4CFi6mn0h.exe
1752	Antarctida_wa65fg57rx04.exe
6300	NPHIJFhXCNUe.exe
6308	Antarctida_yn62z54msax0.exe
6448	rJbVmV11Nok9.exe
6916	WinLock.exe
7004	EIqKrEGcpYay.exe
7152	X1hlAXISYiFp.exe
6396	qiHD0nNx2un9.exe
6456	WinLock.exe
2576	WinLock.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\cQy4E9kIKlG5 = "\"C:\\Users\\Admin\\AppData\\Local\\pxjyajtDzcGl\\gcRzyLeCd6w9.exe\""	Antarctida_d3pdc7owpdt0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\oEaqNhgxgqmY = "\"C:\\Users\\Admin\\AppData\\Local\\lROLPStJTKOs\\lNosi2G6CTlR.exe\""	Antarctida_4b6yp3in9wwp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\FOcTL2XesQ7N = "\"C:\\Users\\Admin\\AppData\\Local\\A2je4wFXNzsW\\4j9E7M0A9kDe.exe\""	Antarctida_4ofb6rsmmild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\PeaNVN5bGHuH = "\"C:\\Users\\Admin\\AppData\\Local\\gsXIjDhARYqC\\pgmhLMEOnCCK.exe\""	Antarctida_36yja3u37vnd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\2BG9KvpQ8uxa = "\"C:\\Users\\Admin\\AppData\\Local\\mj0BYzxEXd4A\\fkJoQSjvXIkj.exe\""	Antarctida_gq1rwsnehpvx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\F7krmvZaGKtZ = "\"C:\\Users\\Admin\\AppData\\Local\\jnpw92AQ0jKu\\Z6h0ae4Lmnt3.exe\""	Antarctida_hbdsvcrfkokj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpX2A1nRODKA = "\"C:\\Users\\Admin\\AppData\\Local\\gF2vJxPMhs6M\\NPHIJFhXCNUe.exe\""	Antarctida_n6tli5ilipd4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\RJbB28eDb6bd = "\"C:\\Users\\Admin\\AppData\\Local\\CiQqGDnyf5dk\\kku0w4oSOqzG.exe\""	Antarctida_hibu6njb1hbs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\wETbXeqsplSJ = "\"C:\\Users\\Admin\\AppData\\Local\\LnQWH19BRljD\\jDFeGCQR3An2.exe\""	Antarctida_6mz21cxhs1tu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\bqD7KUDO6A4G = "\"C:\\Users\\Admin\\AppData\\Local\\zPxJnHtivXPc\\z4GW6T9mz5Tv.exe\""	Antarctida_jzu9wque3pea.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\FX4FFXTwZLEN = "\"C:\\Users\\Admin\\AppData\\Local\\YwB4UScux138\\qiHD0nNx2un9.exe\""	Antarctida_yn62z54msax0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\QVZxJpG05idF = "\"C:\\Users\\Admin\\AppData\\Local\\PFNQ9mwFujOc\\XbMIAQ9pY4mU.exe\""	Antarctida_bya0g4vx2i0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\BpdXIR66CUMf = "\"C:\\Users\\Admin\\AppData\\Local\\CnsopsFRtY1F\\r7i4CFi6mn0h.exe\""	Antarctida_qhxavz3ez0bs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\UYOCsGVo4YAg = "\"C:\\Users\\Admin\\AppData\\Local\\WrMYPFTuRltN\\X1hlAXISYiFp.exe\""	Antarctida_wa65fg57rx04.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\PIwazylltOMd = "\"C:\\Users\\Admin\\AppData\\Local\\93vfkp0zF9ng\\x5E6E4LVP3q8.exe\""	Antarctida_0f0n0usa9hh9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\yC8WnUhaPLBT = "\"C:\\Users\\Admin\\AppData\\Local\\Z3cAEQD8fPfq\\aKft9BhrzQ1g.exe\""	Antarctida_icmln5soaajv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\yOcidX3Fss4i = "\"C:\\Users\\Admin\\AppData\\Local\\DfrYcs5EIUSc\\EIqKrEGcpYay.exe\""	Antarctida_sppw59vmzljt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\""	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\bFZS6HsvBfiT = "\"C:\\Users\\Admin\\AppData\\Local\\SFnqQXLQtnqI\\YhPTEAMCxFPX.exe\""	Antarctida_dp9hittxyh5a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\X4kME2yAjgp7 = "\"C:\\Users\\Admin\\AppData\\Local\\2vJaBstxN3nO\\rJbVmV11Nok9.exe\""	Antarctida_o2l7d9lw3q3m.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\1diZbTif44Ls = "\"C:\\Users\\Admin\\AppData\\Local\\ctnJYM7rhxUB\\7leBeG08WYsT.exe\""	Antarctida_4an4gsa32giq.exe

Looks up external IP address via web service 1 TTPs 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org
16	api.ipify.org
28	api.ipify.org
19	api.ipify.org
37	api.ipify.org
11	api.ipify.org
27	api.ipify.org
30	api.ipify.org
33	api.ipify.org
38	api.ipify.org
39	api.ipify.org
18	api.ipify.org
51	api.ipify.org
2	api.ipify.org
9	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe
5364	cmd.exe
1612	cmd.exe
472	cmd.exe
4728	cmd.exe
704	cmd.exe
5628	cmd.exe
2596	cmd.exe
5072	cmd.exe
5788	cmd.exe
6432	cmd.exe
1312	cmd.exe
4928	cmd.exe
1908	cmd.exe
2276	cmd.exe
1388	cmd.exe
2832	cmd.exe
3864	cmd.exe
2208	cmd.exe
4984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_hbdsvcrfkokj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_qhxavz3ez0bs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fkJoQSjvXIkj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4j9E7M0A9kDe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x5E6E4LVP3q8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	r7i4CFi6mn0h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X1hlAXISYiFp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_jzu9wque3pea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gcRzyLeCd6w9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_bya0g4vx2i0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YhPTEAMCxFPX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_0f0n0usa9hh9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lNosi2G6CTlR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_6mz21cxhs1tu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_gq1rwsnehpvx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_o2l7d9lw3q3m.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7leBeG08WYsT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_4ofb6rsmmild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_icmln5soaajv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_dp9hittxyh5a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pgmhLMEOnCCK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XbMIAQ9pY4mU.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_sppw59vmzljt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Antarctida_hibu6njb1hbs.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 20 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1020	netsh.exe
236	netsh.exe
880	netsh.exe
2780	netsh.exe
4956	netsh.exe
4076	netsh.exe
5824	netsh.exe
6168	netsh.exe
6460	netsh.exe
2604	netsh.exe
696	netsh.exe
5900	netsh.exe
6904	netsh.exe
4568	netsh.exe
4912	netsh.exe
1520	netsh.exe
2692	netsh.exe
3244	netsh.exe
4956	netsh.exe
2392	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6460	msedge.exe

Delays execution with timeout.exe 20 IoCs

defense_evasion

pid	Process
3240	timeout.exe
3608	timeout.exe
7112	timeout.exe
1884	timeout.exe
4848	timeout.exe
4384	timeout.exe
1520	timeout.exe
6024	timeout.exe
3064	timeout.exe
5992	timeout.exe
2060	timeout.exe
5856	timeout.exe
4084	timeout.exe
4092	timeout.exe
4724	timeout.exe
1752	timeout.exe
3360	timeout.exe
2392	timeout.exe
7032	timeout.exe
4244	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 20 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5180	schtasks.exe
5928	schtasks.exe
1884	schtasks.exe
4128	schtasks.exe
3804	schtasks.exe
1164	schtasks.exe
1920	schtasks.exe
4944	schtasks.exe
2956	schtasks.exe
252	schtasks.exe
4140	schtasks.exe
704	schtasks.exe
2156	schtasks.exe
4484	schtasks.exe
2868	schtasks.exe
4344	schtasks.exe
3264	schtasks.exe
3936	schtasks.exe
1428	schtasks.exe
6420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
2044	plikan.exe
5836	Antarctida_4an4gsa32giq.exe
4304	Antarctida_4b6yp3in9wwp.exe
5836	Antarctida_4an4gsa32giq.exe
4304	Antarctida_4b6yp3in9wwp.exe
3260	Antarctida_0f0n0usa9hh9.exe
3260	Antarctida_0f0n0usa9hh9.exe
5836	Antarctida_4an4gsa32giq.exe
4304	Antarctida_4b6yp3in9wwp.exe
4304	Antarctida_4b6yp3in9wwp.exe
3260	Antarctida_0f0n0usa9hh9.exe
2128	Antarctida_4ofb6rsmmild.exe
2128	Antarctida_4ofb6rsmmild.exe
2128	Antarctida_4ofb6rsmmild.exe
4068	Antarctida_6mz21cxhs1tu.exe
4068	Antarctida_6mz21cxhs1tu.exe
4068	Antarctida_6mz21cxhs1tu.exe
5772	Antarctida_36yja3u37vnd.exe
5772	Antarctida_36yja3u37vnd.exe
5772	Antarctida_36yja3u37vnd.exe
6004	Antarctida_bya0g4vx2i0d.exe
6004	Antarctida_bya0g4vx2i0d.exe
6004	Antarctida_bya0g4vx2i0d.exe
2144	Antarctida_d3pdc7owpdt0.exe
2144	Antarctida_d3pdc7owpdt0.exe
2144	Antarctida_d3pdc7owpdt0.exe
3452	Antarctida_dp9hittxyh5a.exe
3452	Antarctida_dp9hittxyh5a.exe
3452	Antarctida_dp9hittxyh5a.exe
2268	Antarctida_gq1rwsnehpvx.exe
2268	Antarctida_gq1rwsnehpvx.exe
2268	Antarctida_gq1rwsnehpvx.exe
1988	Antarctida_hbdsvcrfkokj.exe
1988	Antarctida_hbdsvcrfkokj.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	plikan.exe
Token: SeDebugPrivilege	5836	Antarctida_4an4gsa32giq.exe
Token: SeDebugPrivilege	3260	Antarctida_0f0n0usa9hh9.exe
Token: SeDebugPrivilege	4304	Antarctida_4b6yp3in9wwp.exe
Token: SeDebugPrivilege	2128	Antarctida_4ofb6rsmmild.exe
Token: SeDebugPrivilege	4068	Antarctida_6mz21cxhs1tu.exe
Token: SeDebugPrivilege	5772	Antarctida_36yja3u37vnd.exe
Token: SeDebugPrivilege	6004	Antarctida_bya0g4vx2i0d.exe
Token: SeDebugPrivilege	2144	Antarctida_d3pdc7owpdt0.exe
Token: SeDebugPrivilege	3452	Antarctida_dp9hittxyh5a.exe
Token: SeDebugPrivilege	2268	Antarctida_gq1rwsnehpvx.exe
Token: SeDebugPrivilege	1988	Antarctida_hbdsvcrfkokj.exe
Token: SeDebugPrivilege	4532	Antarctida_hibu6njb1hbs.exe
Token: SeDebugPrivilege	1800	Antarctida_icmln5soaajv.exe
Token: SeDebugPrivilege	1528	Antarctida_jzu9wque3pea.exe
Token: SeDebugPrivilege	1836	Antarctida_n6tli5ilipd4.exe
Token: SeDebugPrivilege	932	Antarctida_o2l7d9lw3q3m.exe
Token: SeDebugPrivilege	3908	Antarctida_qhxavz3ez0bs.exe
Token: SeDebugPrivilege	4684	Antarctida_sppw59vmzljt.exe
Token: SeDebugPrivilege	1752	Antarctida_wa65fg57rx04.exe
Token: SeDebugPrivilege	6308	Antarctida_yn62z54msax0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3260	2044	plikan.exe	89
PID 2044 wrote to memory of 5836	2044	plikan.exe	90
PID 2044 wrote to memory of 4304	2044	plikan.exe	91
PID 4304 wrote to memory of 4140	4304	Antarctida_4b6yp3in9wwp.exe	92
PID 3260 wrote to memory of 1164	3260	Antarctida_0f0n0usa9hh9.exe	93
PID 5836 wrote to memory of 3264	5836	Antarctida_4an4gsa32giq.exe	210
PID 4304 wrote to memory of 1388	4304	Antarctida_4b6yp3in9wwp.exe	95
PID 5836 wrote to memory of 2276	5836	Antarctida_4an4gsa32giq.exe	96
PID 3260 wrote to memory of 5364	3260	Antarctida_0f0n0usa9hh9.exe	98
PID 2044 wrote to memory of 2128	2044	plikan.exe	99
PID 2128 wrote to memory of 1920	2128	Antarctida_4ofb6rsmmild.exe	105
PID 2128 wrote to memory of 1612	2128	Antarctida_4ofb6rsmmild.exe	106
PID 1388 wrote to memory of 4724	1388	cmd.exe	217
PID 2044 wrote to memory of 4068	2044	plikan.exe	110
PID 5836 wrote to memory of 696	5836	Antarctida_4an4gsa32giq.exe	111
PID 5364 wrote to memory of 1884	5364	cmd.exe	226
PID 4304 wrote to memory of 4568	4304	Antarctida_4b6yp3in9wwp.exe	113
PID 4068 wrote to memory of 3936	4068	Antarctida_6mz21cxhs1tu.exe	114
PID 2128 wrote to memory of 2604	2128	Antarctida_4ofb6rsmmild.exe	117
PID 3260 wrote to memory of 2392	3260	Antarctida_0f0n0usa9hh9.exe	264
PID 4068 wrote to memory of 472	4068	Antarctida_6mz21cxhs1tu.exe	119
PID 472 wrote to memory of 1752	472	cmd.exe	263
PID 4068 wrote to memory of 880	4068	Antarctida_6mz21cxhs1tu.exe	131
PID 2044 wrote to memory of 5772	2044	plikan.exe	129
PID 2276 wrote to memory of 2060	2276	cmd.exe	132
PID 5772 wrote to memory of 4944	5772	Antarctida_36yja3u37vnd.exe	134
PID 5772 wrote to memory of 2832	5772	Antarctida_36yja3u37vnd.exe	135
PID 1612 wrote to memory of 4244	1612	cmd.exe	138
PID 2044 wrote to memory of 6004	2044	plikan.exe	139
PID 6004 wrote to memory of 5180	6004	Antarctida_bya0g4vx2i0d.exe	141
PID 5772 wrote to memory of 4912	5772	Antarctida_36yja3u37vnd.exe	142
PID 6004 wrote to memory of 3864	6004	Antarctida_bya0g4vx2i0d.exe	143
PID 2044 wrote to memory of 2144	2044	plikan.exe	151
PID 6004 wrote to memory of 1020	6004	Antarctida_bya0g4vx2i0d.exe	152
PID 2144 wrote to memory of 704	2144	Antarctida_d3pdc7owpdt0.exe	237
PID 2144 wrote to memory of 1312	2144	Antarctida_d3pdc7owpdt0.exe	154
PID 2144 wrote to memory of 1520	2144	Antarctida_d3pdc7owpdt0.exe	209
PID 2044 wrote to memory of 3452	2044	plikan.exe	161
PID 2832 wrote to memory of 3240	2832	cmd.exe	164
PID 3452 wrote to memory of 5928	3452	Antarctida_dp9hittxyh5a.exe	165
PID 3452 wrote to memory of 2208	3452	Antarctida_dp9hittxyh5a.exe	166
PID 2044 wrote to memory of 2268	2044	plikan.exe	169
PID 3452 wrote to memory of 2692	3452	Antarctida_dp9hittxyh5a.exe	170
PID 2268 wrote to memory of 2156	2268	Antarctida_gq1rwsnehpvx.exe	240
PID 2268 wrote to memory of 4928	2268	Antarctida_gq1rwsnehpvx.exe	174
PID 3864 wrote to memory of 3360	3864	cmd.exe	175
PID 2268 wrote to memory of 2780	2268	Antarctida_gq1rwsnehpvx.exe	179
PID 1312 wrote to memory of 4848	1312	cmd.exe	180
PID 2044 wrote to memory of 1988	2044	plikan.exe	183
PID 1988 wrote to memory of 2956	1988	Antarctida_hbdsvcrfkokj.exe	184
PID 1988 wrote to memory of 4984	1988	Antarctida_hbdsvcrfkokj.exe	185
PID 1988 wrote to memory of 4956	1988	Antarctida_hbdsvcrfkokj.exe	232
PID 2208 wrote to memory of 3608	2208	cmd.exe	192
PID 2044 wrote to memory of 4532	2044	plikan.exe	194
PID 4532 wrote to memory of 1428	4532	Antarctida_hibu6njb1hbs.exe	196
PID 4532 wrote to memory of 5628	4532	Antarctida_hibu6njb1hbs.exe	197
PID 4928 wrote to memory of 4384	4928	cmd.exe	200
PID 4532 wrote to memory of 3244	4532	Antarctida_hibu6njb1hbs.exe	202
PID 2044 wrote to memory of 1800	2044	plikan.exe	205
PID 1800 wrote to memory of 4484	1800	Antarctida_icmln5soaajv.exe	206
PID 1800 wrote to memory of 1908	1800	Antarctida_icmln5soaajv.exe	208
PID 4984 wrote to memory of 1520	4984	cmd.exe	209
PID 2044 wrote to memory of 1528	2044	plikan.exe	212
PID 1800 wrote to memory of 4076	1800	Antarctida_icmln5soaajv.exe	213

C:\Users\Admin\AppData\Local\Temp\plikan.exe
"C:\Users\Admin\AppData\Local\Temp\plikan.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "NvmBx8Q37DI2" /tr "\"C:\Users\Admin\AppData\Local\93vfkp0zF9ng\x5E6E4LVP3q8.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\e1164b289bc14968b255351d2f99cf31.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5364
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1884
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2392
- C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "cknQEIr9JPuu" /tr "\"C:\Users\Admin\AppData\Local\ctnJYM7rhxUB\7leBeG08WYsT.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\323ba3dd69354f43acf1166b6c5385f6.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2060
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:696
- C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "CsRtqH8aJEur" /tr "\"C:\Users\Admin\AppData\Local\lROLPStJTKOs\lNosi2G6CTlR.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7f55cb1fc3754776ab630b1e90baebf4.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4724
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4568
- C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "fatAbW1rQC6v" /tr "\"C:\Users\Admin\AppData\Local\A2je4wFXNzsW\4j9E7M0A9kDe.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\f39c8d2da5e94da4b79e6e571176967d.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4244
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2604
- C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "wGIYP8Ahq5gL" /tr "\"C:\Users\Admin\AppData\Local\LnQWH19BRljD\jDFeGCQR3An2.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\376ef392abfd4088a3e7d6612717ceee.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:472
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1752
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:880
- C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "ZIrxTniFIEbs" /tr "\"C:\Users\Admin\AppData\Local\gsXIjDhARYqC\pgmhLMEOnCCK.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\615c8d8ccb9e428d8d4b3067d3f07851.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3240
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4912
- C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "9cPtFNMYTeKb" /tr "\"C:\Users\Admin\AppData\Local\PFNQ9mwFujOc\XbMIAQ9pY4mU.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5180
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3c851df053184f3a9459a2d22b7d06fa.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3360
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1020
- C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "MGAC0GUyWOxr" /tr "\"C:\Users\Admin\AppData\Local\pxjyajtDzcGl\gcRzyLeCd6w9.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1d2875146e3047768beb8370c1f77aa2.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4848
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1520
- C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "9JGMQFm8RZ9t" /tr "\"C:\Users\Admin\AppData\Local\SFnqQXLQtnqI\YhPTEAMCxFPX.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\91cb115fd9764bf5a156d0b645757b47.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3608
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2692
- C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "8w6XAM0A3uWZ" /tr "\"C:\Users\Admin\AppData\Local\mj0BYzxEXd4A\fkJoQSjvXIkj.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\ee2bdde3c04f4ba9a25b8b0bf8665d97.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4384
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2780
- C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "oIz3ZvqX7qZt" /tr "\"C:\Users\Admin\AppData\Local\jnpw92AQ0jKu\Z6h0ae4Lmnt3.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2956
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\fabad7263acb4adca075d98293f3b5e3.bat"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1520
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4956
- C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "0BJBujmFX4tU" /tr "\"C:\Users\Admin\AppData\Local\CiQqGDnyf5dk\kku0w4oSOqzG.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\0b8e7e6df44b404093e77cc8578d6012.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5628
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:6024
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3244
- C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "kIbAyiEeqR46" /tr "\"C:\Users\Admin\AppData\Local\Z3cAEQD8fPfq\aKft9BhrzQ1g.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\046e528139ff4117b6f519a603c637e3.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3264
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5856
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4724
- C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "BB3WxcchMkxo" /tr "\"C:\Users\Admin\AppData\Local\zPxJnHtivXPc\z4GW6T9mz5Tv.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\42c100fa767c4f62b2c18c1934a984d3.bat"
    3⤵
    - Executes a command shell one-liner
    PID:4728
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4084
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5824
- C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1836
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "iREP5OpMKNY6" /tr "\"C:\Users\Admin\AppData\Local\gF2vJxPMhs6M\NPHIJFhXCNUe.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1884
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\9da18fcaa52e4a48b5f22dfbf732db85.bat"
    3⤵
    - Executes a command shell one-liner
    PID:2596
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:3064
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:4956
- C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "IkYTgjJJaBYd" /tr "\"C:\Users\Admin\AppData\Local\2vJaBstxN3nO\rJbVmV11Nok9.exe\"" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4128
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2868
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1a4fe947171841e6867d1c31581b907e.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:704
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2392
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5900
- C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "geIHWKrL0mY0" /tr "\"C:\Users\Admin\AppData\Local\CnsopsFRtY1F\r7i4CFi6mn0h.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:252
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\65b62fc836c74991ae560edf9427c810.bat"
    3⤵
    - Executes a command shell one-liner
    PID:5072
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:5992
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:236
- C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "9sEnGC7XiYEv" /tr "\"C:\Users\Admin\AppData\Local\DfrYcs5EIUSc\EIqKrEGcpYay.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4344
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\07b00634cb8843edb3b975ccd2a025f6.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7032
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6168
- C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "gjVitsWrplZT" /tr "\"C:\Users\Admin\AppData\Local\WrMYPFTuRltN\X1hlAXISYiFp.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4e90f36ddcfc4756a00dfbb625716151.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4832
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7112
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6460
- C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe
  "C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:6308
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "EsLK4VLTCWzH" /tr "\"C:\Users\Admin\AppData\Local\YwB4UScux138\qiHD0nNx2un9.exe\"" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6420
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\78efc729b8cd4769837a2b6073c8fa65.bat"
    3⤵
    - Executes a command shell one-liner
    PID:6432
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4092
- - C:\Windows\SysWOW64\netsh.exe
    "netsh" wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6904
- C:\Users\Admin\AppData\Local\Temp\WinLock.exe
  "C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6916

C:\Users\Admin\AppData\Local\A2je4wFXNzsW\4j9E7M0A9kDe.exe
"C:\Users\Admin\AppData\Local\A2je4wFXNzsW\4j9E7M0A9kDe.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1200

C:\Users\Admin\AppData\Local\93vfkp0zF9ng\x5E6E4LVP3q8.exe
"C:\Users\Admin\AppData\Local\93vfkp0zF9ng\x5E6E4LVP3q8.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:560

C:\Users\Admin\AppData\Local\ctnJYM7rhxUB\7leBeG08WYsT.exe
"C:\Users\Admin\AppData\Local\ctnJYM7rhxUB\7leBeG08WYsT.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152

C:\Users\Admin\AppData\Local\LnQWH19BRljD\jDFeGCQR3An2.exe
"C:\Users\Admin\AppData\Local\LnQWH19BRljD\jDFeGCQR3An2.exe"
1⤵
- Executes dropped EXE
PID:4344

C:\Users\Admin\AppData\Local\lROLPStJTKOs\lNosi2G6CTlR.exe
"C:\Users\Admin\AppData\Local\lROLPStJTKOs\lNosi2G6CTlR.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1360

C:\Users\Admin\AppData\Local\gsXIjDhARYqC\pgmhLMEOnCCK.exe
"C:\Users\Admin\AppData\Local\gsXIjDhARYqC\pgmhLMEOnCCK.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5040

C:\Users\Admin\AppData\Local\pxjyajtDzcGl\gcRzyLeCd6w9.exe
"C:\Users\Admin\AppData\Local\pxjyajtDzcGl\gcRzyLeCd6w9.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:824

C:\Users\Admin\AppData\Local\PFNQ9mwFujOc\XbMIAQ9pY4mU.exe
"C:\Users\Admin\AppData\Local\PFNQ9mwFujOc\XbMIAQ9pY4mU.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3792

C:\Users\Admin\AppData\Local\SFnqQXLQtnqI\YhPTEAMCxFPX.exe
"C:\Users\Admin\AppData\Local\SFnqQXLQtnqI\YhPTEAMCxFPX.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6124

C:\Users\Admin\AppData\Local\mj0BYzxEXd4A\fkJoQSjvXIkj.exe
"C:\Users\Admin\AppData\Local\mj0BYzxEXd4A\fkJoQSjvXIkj.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:704

C:\Users\Admin\AppData\Local\jnpw92AQ0jKu\Z6h0ae4Lmnt3.exe
"C:\Users\Admin\AppData\Local\jnpw92AQ0jKu\Z6h0ae4Lmnt3.exe"
1⤵
- Executes dropped EXE
PID:4732

C:\Users\Admin\AppData\Local\CiQqGDnyf5dk\kku0w4oSOqzG.exe
"C:\Users\Admin\AppData\Local\CiQqGDnyf5dk\kku0w4oSOqzG.exe"
1⤵
- Executes dropped EXE
PID:824

C:\Users\Admin\AppData\Local\Z3cAEQD8fPfq\aKft9BhrzQ1g.exe
"C:\Users\Admin\AppData\Local\Z3cAEQD8fPfq\aKft9BhrzQ1g.exe"
1⤵
- Executes dropped EXE
PID:3164

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2156

C:\Users\Admin\AppData\Local\zPxJnHtivXPc\z4GW6T9mz5Tv.exe
"C:\Users\Admin\AppData\Local\zPxJnHtivXPc\z4GW6T9mz5Tv.exe"
1⤵
- Executes dropped EXE
PID:2764

C:\Users\Admin\AppData\Local\CnsopsFRtY1F\r7i4CFi6mn0h.exe
"C:\Users\Admin\AppData\Local\CnsopsFRtY1F\r7i4CFi6mn0h.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5116

C:\Users\Admin\AppData\Local\gF2vJxPMhs6M\NPHIJFhXCNUe.exe
"C:\Users\Admin\AppData\Local\gF2vJxPMhs6M\NPHIJFhXCNUe.exe"
1⤵
- Executes dropped EXE
PID:6300

C:\Users\Admin\AppData\Local\2vJaBstxN3nO\rJbVmV11Nok9.exe
"C:\Users\Admin\AppData\Local\2vJaBstxN3nO\rJbVmV11Nok9.exe"
1⤵
- Executes dropped EXE
PID:6448

C:\Users\Admin\AppData\Local\DfrYcs5EIUSc\EIqKrEGcpYay.exe
"C:\Users\Admin\AppData\Local\DfrYcs5EIUSc\EIqKrEGcpYay.exe"
1⤵
- Executes dropped EXE
PID:7004

C:\Users\Admin\AppData\Local\WrMYPFTuRltN\X1hlAXISYiFp.exe
"C:\Users\Admin\AppData\Local\WrMYPFTuRltN\X1hlAXISYiFp.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7152

C:\Users\Admin\AppData\Local\YwB4UScux138\qiHD0nNx2un9.exe
"C:\Users\Admin\AppData\Local\YwB4UScux138\qiHD0nNx2un9.exe"
1⤵
- Executes dropped EXE
PID:6396

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
- Executes dropped EXE
PID:6456

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Executes dropped EXE
PID:2576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CopyOptimize.xml
1⤵
PID:6528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff866aac188,0x7ff866aac194,0x7ff866aac1a0
  2⤵
  PID:5676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1860,i,6846523346149681046,10812289774327365206,262144 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,13585699671857397362,8031619327231150144,524288 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,3885142866012387985,10433998776331865525,524288 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:13
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,17822898726014549629,12958526136399632550,2097152 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,8492892477289300588,9061712861844146219,2097152 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,5414883726241634200,10816281250439252300,2097152 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,13408592265061744576,5418374789062764490,2097152 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:9
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3968,i,6043829746744194843,1494326535154631494,2097152 --field-trial-handle=2272,i,7542336240781352726,15573689382397892129,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\CopyOptimize.xml
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 71609ab232635fc0b3b5aa353f6ccf27bab731b1113f22f4832b43e325cdfa1c
MD5 278289351cbcf5328ead916ea352b3e0
SHA1 d83009dfb52585a236760aaff37f5b61c4635daf
SHA512 b9798a74a6614741e69bf4c9f72030c9c8fc3cab5bdb76486fb14ab6f47222a57e9f47183feef9e95f6bcd425ad9745f9fd7cb206119bf78781b2c2802a4396a
SSDEEP 768:Rrv+4UNbd43MPkc+wfZOsfcR66I/vShCQtG2bwWV:RbsbO3M2wf7f16I/vSK0wO
TLSH
T12203CF32E86899339DE782487646BB637EB96173C8C54784D6DD5B0D028369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3822cf6b55615251cd5e9b466adc3ff0a8a52c2ca8c93f82ac90db7a1233354a
MD5 0adf3b1875590a339acc221cb5d52fcf
SHA1 c2c60b70d3d41f16b0a5e26680028321d4d04b31
SHA512 de5bfa727252f8acef23450e9bdb7c99fef43b4b9fc257b51cb99bf212ad45aac0cf907cca077064ee585a348da28b95508a2c116dea24be9433f31c1546b5f4
SSDEEP 768:Mrv+4UNbd43GZtc+wfZOsfcR66Igfcl66hvShCQsQ2bwWV:MbsbO3mwf7f16Igf56hvS30wO
TLSH
T1D003CF72E8786A739EE38644760ABB13BFB55263C4C54784DADD1B0D028769F331BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5500bd7b92cf1fb5939bdd18573b5eb7a4fed7456c8917f4ed18793b398409fa
MD5 bffd5402921c0aff0bd99734411ac919
SHA1 4d90fd1ff7125a07d816978f69b297376b2202cb
SHA512 2f0da483ecc69ed45dbd2f57d0d4e0654f563a545901cf3c652a065728ac5945c9252baf63fbac17355dbdc7ff2e61cea9638395746f19c1c4f8d08ffcc0f95d
SSDEEP 768:krv+4UNbd433svc+wfZOsfcR66Igfcl66hvShCQRQ2bwW2:kbsbO3ywf7f16Igf56hvSU0w5
TLSH
T17803BF72E8786A739EE38644760ABB13BFB95163C4C54684DADD1F0D028769F331BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

046e528139ff4117b6f519a603c637e3.bat

Path C:\Users\Admin\AppData\Local\Temp\046e528139ff4117b6f519a603c637e3.bat
Size 128B
SHA256 7d169718839bb51b1b6ce32a85efe7e0642d1d5e7b7bd82ae1b6f6553de7185c
MD5 cd53ec68a1abbaa5c1c07f06893534a2
SHA1 628ecae09e229eb82c2d05b42961e1404a478763
SHA512 b8d31a202c6c20b0c82290907d6ed48efd23d5c3a42e7f8a8eaf775fda7fdf1a53751ecdd616546bf5e7d665497dd8034123113e8767669c43e1723ecec847b4
TLSH
T181B02B1731A543CC140200A106BF20C0007E40C199045447060340BE854503A6017DC3
MD5 SHA1 SHA512 TLSH

Submit Download

0b8e7e6df44b404093e77cc8578d6012.bat

Path C:\Users\Admin\AppData\Local\Temp\0b8e7e6df44b404093e77cc8578d6012.bat
Size 128B
SHA256 d67e0a079ecbb2d0986fdf1d586c9eae2147641a713ce412e7dc63ad37be1ad9
MD5 3217c47cd4139b972a1e2c394a0b7233
SHA1 8c9b273f9598e78460d98beba575e960d5325aaf
SHA512 6a03c72cd387b85c830351f887487f363d9dd5753998ebbf0f435e03b67dd058572034620ad2a70ffe1a76652f224215f576b8e2915ac4232916fd1680411507
TLSH
T184B02B322295C7CC180110F247FF3044206F40C1590050462241407EC186C329013CC1
MD5 SHA1 SHA512 TLSH

Submit Download

1a4fe947171841e6867d1c31581b907e.bat

Path C:\Users\Admin\AppData\Local\Temp\1a4fe947171841e6867d1c31581b907e.bat
Size 128B
SHA256 7d3b5a8b76bde8340ddb41da83735212ccaf9811705b168472253bb306e6020e
MD5 0437be09bf8400deee07d6eb3eeac762
SHA1 7e9447f3addf7a5437a37ff9d7e8323eae86b1df
SHA512 240a8f84e2dc059da5598e32a3972362e5b087d8915548108307b2283eea1e66ea165e20c61ac78685fef17bf29b07d9307cc4426b9d1017fda5210ff2574fce
TLSH
T17DB02B17219583CC340200B106FF31C8406F40C169089082020140BF81454329013CC2
MD5 SHA1 SHA512 TLSH

Submit Download

1d2875146e3047768beb8370c1f77aa2.bat

Path C:\Users\Admin\AppData\Local\Temp\1d2875146e3047768beb8370c1f77aa2.bat
Size 128B
SHA256 a3cae793b8d04113aed6761d3b9c4bcd6af86150d5d13c78ed2e312b174ab0bb
MD5 1bf761209f818c6bbc2e3596462f68b2
SHA1 8150ea0742422b6e13dfc63c0e6408a94bc8e03f
SHA512 b639116453d84c8abad0ad1cdfeb9df90fb169b21f7ab1ee2554b8ce26438c00b91261b70168b00ea980caf3a441bd1f454db9942ec0a87a2df8339835bbd54a
TLSH
T1D5B09B26316547CD140210B246EF3187546E51C15E0854465546857EC6854766457DC5
MD5 SHA1 SHA512 TLSH

Submit Download

323ba3dd69354f43acf1166b6c5385f6.bat

Path C:\Users\Admin\AppData\Local\Temp\323ba3dd69354f43acf1166b6c5385f6.bat
Size 128B
SHA256 1ece512c698b571db9ef59cb37418dfc3aba1f5aa1219d8c45eacc78a0bd8220
MD5 e3ab148164e9e60d99a4cf2cf63f84ae
SHA1 d1ac3971d715def6687e1cc821fd6d8ff4e92f2b
SHA512 e0afe80de58acc2ebc77f4376a274ade42de709d3f1bab199be646bbb6f50263604ae2e3d3809f7409b176c42fe3a927713ab0a48394212d17dbcf1c8d2cf7f2
TLSH
T12EB09B16215547DD150110F146BF2545106F94C75A445546555744BE85894365817FC5
MD5 SHA1 SHA512 TLSH

Submit Download

376ef392abfd4088a3e7d6612717ceee.bat

Path C:\Users\Admin\AppData\Local\Temp\376ef392abfd4088a3e7d6612717ceee.bat
Size 128B
SHA256 22ddd152c73e3c7f9998534843c1cd83f4f578ad70ec8d40766e15749df66198
MD5 546fcc96ea08ffb0893a7ed35edab5aa
SHA1 a163909e9bbf0d688e9cc60ed5f0cc7e6e089f1d
SHA512 98a5e867a1996801780136048dbf304d5cff97d0576763864810d636f5500ad035676cf1b5f7ac402abc488923d301a5f2bdabf17e64c2f183dc98a270dfd15b
TLSH
T1C6B09B17615547DD140210B146BF31C5106E50E15904D447575684BED5C54375417DC6
MD5 SHA1 SHA512 TLSH

Submit Download

3c851df053184f3a9459a2d22b7d06fa.bat

Path C:\Users\Admin\AppData\Local\Temp\3c851df053184f3a9459a2d22b7d06fa.bat
Size 128B
SHA256 c9c2a72350a732048eb8e23683f168cd341d3a2534325de4414e2c0a761652b3
MD5 2da3870aae89ef4a584b199035c42014
SHA1 cde4b62cf7e47a5dd3fac45f1a4cd0dfb1135fbd
SHA512 1f2a00cad704aab49e5a7d2fcc37ebc56a64a737322edc0ceb19526b00135b92d3bf40887adf0e96d9932df5fd341fc0d4c1a3e3948d5dd3701f53c7abf8008e
TLSH
T1D3B02B12209643CC140620B30BAF2040106E40C15A009042470149BE85C90326023DD2
MD5 SHA1 SHA512 TLSH

Submit Download

42c100fa767c4f62b2c18c1934a984d3.bat

Path C:\Users\Admin\AppData\Local\Temp\42c100fa767c4f62b2c18c1934a984d3.bat
Size 128B
SHA256 c36bdc1b3c51d62dc1790e572b885588326b20225c39360579e9447986b178a6
MD5 9ef1d7a56ebcc93ddaad37739240afca
SHA1 85e6b031551432cdb661ebefa218d55a064bf09c
SHA512 63e20a2abba41e3eb3366b7b126b1ac73f121d90d410e0825017c3a1726a05cbca6730eac14bade92ed92475baffd805e33934f654d6b6ad6d24d6d69276beb5
TLSH
T109B02B16306A4BCD140110A146BF2041006E40C16D0050420101407E954A0325027DC5
MD5 SHA1 SHA512 TLSH

Submit Download

615c8d8ccb9e428d8d4b3067d3f07851.bat

Path C:\Users\Admin\AppData\Local\Temp\615c8d8ccb9e428d8d4b3067d3f07851.bat
Size 128B
SHA256 980e6994f2fd52a5c0f6520fb89b41115a474ebe2c14de4674338c2e352e8e64
MD5 5a987c1fb5e9431fb915f33ffbf8d0f0
SHA1 d9bc4b114f5b9fdc7b7323ed412901d18ba53cad
SHA512 92a96e5c4a617399cc0efbac910a008da7d06598cadc54622dc4534eb07f3e234ceacc11e8eb15c010bce1f191bb87777f003788e7d59f0fd5c7870c85666ca6
TLSH
T1FEB02B12325943DD140104B107EF2040006E80C1690050420303407EC1460369417DC1
MD5 SHA1 SHA512 TLSH

Submit Download

7f55cb1fc3754776ab630b1e90baebf4.bat

Path C:\Users\Admin\AppData\Local\Temp\7f55cb1fc3754776ab630b1e90baebf4.bat
Size 128B
SHA256 c20d5f60ca0738419c8168d7405cb86015cfff1984f05b4f2282ed73d2e31214
MD5 d085d13878e9ff6236700d79992108bb
SHA1 019c07262346b3db77ef077b5a650968ad3c071a
SHA512 be11c7c5b4948bb1fc660d63be8a9031979e149f555f956d3f052c74828384474ac79060cfe32202e660d54727df51f6203aef34da5ceaf568c77bb1d06fb63b
TLSH
T12BB09B17219987CD184214E34AFF2295507E54C55E0454464555547E864A8765417DC5
MD5 SHA1 SHA512 TLSH

Submit Download

91cb115fd9764bf5a156d0b645757b47.bat

Path C:\Users\Admin\AppData\Local\Temp\91cb115fd9764bf5a156d0b645757b47.bat
Size 128B
SHA256 0f40c9926bf8eaab62e42120b94ee82e771c713227ded007b5a7773894bec88f
MD5 39e91ab3cf48edef40aeb811b062db19
SHA1 d072cd98f4dc30b1fc0e0583a5267372c128dfd2
SHA512 add1d2dec4c65e89cf2937562c1886751116cc0b48ebec06b502a1746db6bde61c0a9f1409a264214d9dba6e9bf3bb9fa60c9e80ed160c74fb3622ba807e038e
TLSH
T17AB09B273165C7CD240510E146EF214514BE90C6590494564546447E964A4766457DC5
MD5 SHA1 SHA512 TLSH

Submit Download

9da18fcaa52e4a48b5f22dfbf732db85.bat

Path C:\Users\Admin\AppData\Local\Temp\9da18fcaa52e4a48b5f22dfbf732db85.bat
Size 128B
SHA256 fc391ad36223e794c90b3f073e010ab8fd9fb4cbd91a3af3a4de10525732cf3b
MD5 a2c81121ef4fdf83aae6acc924f1570f
SHA1 97e35b382353968ada172f3c6d678b6a47eb0aef
SHA512 b2dd79b509050d649fe5a4d0dad328597f4cb9976c27bb0cff6a28c5b3837bbf3cad04ee753293b76dea505e5f0c098b1a678bc2ca8e3955812c0c316a288852
TLSH
T1D2B02B1631E943CD180100B146AF3142017E40C25D0054420106407E86494326017CC1
MD5 SHA1 SHA512 TLSH

Submit Download

WinLock.exe

Path C:\Users\Admin\AppData\Local\Temp\WinLock.exe
Size 240KB
SHA256 547787bf69d6177f08df9d915623613ed30d49c6969d60d571a51dd4c98fd93a
MD5 7c5bbcfa3ae58ba9949be167fd4ea7eb
SHA1 b86c4e18c86c4cfeb45d1a97ac85eb948446170e
SHA512 fb30637faf5cd1d07d6c6937c24ecbfe0828a333dbc13eeb75b2d414ffc01845c23c89e6a85a2a71ec2f88f75ed10a2d4032c4c503fdd6d4bdb807034acbdec4
SSDEEP 6144:tEhfGkH3dZEXuQLL9qAeUaKkg58SCpMW90KImQiXnUbut:y+wdyr9D
TLSH
T1EA346C98136A897DC6BD27BED0A105060BF1B227D103E75CBEECA0E66F27311A741B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_01c4ffc1888547e18a0c9182a09cca3e\Information.txt
Size 281B
SHA256 659279bcefc18b79f535e6e32580514ebfeca48a3529fdba3909dbc20852f6e3
MD5 0045cabb8dfe743c2ebad30f695ba331
SHA1 ef1f05631e9432c7906ab8e9a5f4a80cb7e2d6cb
SHA512 dc253015c47be2112be114e6d59ac2fcd6b36d4ba790438d9e0d8b29ed8f266b20ca27948dbcc79cfd2fc2def952478e85b987f0ce527e385640c4bf84b4c686
TLSH
T145D02B30C35D4C0E42E5207B0306372360FDE0C325A90ADC7CCC8366AC560C09915A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_24a4e9d09a9e4b08915ab800f2327c85\Information.txt
Size 268B
SHA256 9ba0e990602cea259940b00d2f6ace6b111676405c9fc19c264d6c4089b239ad
MD5 cbf9ca8e6f780ff6217de716c5c5cbd8
SHA1 4d023130b59862ce0f4728b107046090f042d929
SHA512 91421fbf2c06bd92371673aa58081c8ba4930ad5c334a1551e3f98c6fd725adb2cd0927c3cf1b263c9ba131f9edf889d03cec6bad6ae415cad2b1164d41d3dfc
TLSH
T198D09520831D0C0E11D4007B0306371301FAD0C3116909DC7CDD5373BD580C05951D9E
MD5 SHA1 SHA512 TLSH

Submit Download

Screenshot.png

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_8b59ee1b5a284571a4d341a959096070\Screenshot.png
Size 380KB
SHA256 6c3c8d03266a6c56ad18e4ca222d25bf300ec53e2f580513fb38fba5d0c08d6b
MD5 2b395f6cce84315436a249662755f71d
SHA1 424626263c2a5fc36009e37c498038de873e1ddd
SHA512 2d31dcfe5f8d62066536236b79129b9ae534fd672a824d664a8752444c74e119c7bac250d13cf580fde6a8f2010e705f576c820dfdd71830f407460bec4425bf
SSDEEP 6144:BHZt5rybJI/ZY1rlCTWAvTS4Dp5lZnzjs0IbMJtjqEjCF/UG:BHZt5rybJQ8rlCTWqrLldzjs0IbSvWJ
TLSH
T12084120DA2A3D51ECDDF56B7E9C18CD867A2C823DD002A7E947B3114D442E7E3265B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_95fc489d41bc4a048edca698f00e0b68\Browsers\Edge\Default\History.txt
Size 175B
SHA256 77ad0643557f56d53eabc95fb6e9af715c9950bcb3e96ef4f3a3fcce06f7e9c1
MD5 64ec805e350a083a28c88e3e36028577
SHA1 0aaf2f7b9def6b8257ef720b2e25ad6b82834f9a
SHA512 1a7cd9de12dad315692ab562f91af883913af57989e46b9d039e280c2c2c561f1c2d95d3e9325c177e37c4c0dda152e631c709527a39bc9ac70a6795a98f3958
TLSH
T161C09218CD9994E5572AC038BA4AC014EE1AA10A9E88213691DA544AA814A6E22CE8FA
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_95fc489d41bc4a048edca698f00e0b68\Browsers\Firefox\dzn6qwxz.default-release\Bookmarks.txt
Size 111B
SHA256 daac6a48e7ccbc245d710df1fa0eceb380e8a099e3f38e4511e6b7050bd051f7
MD5 d4ab3a0758b53320e7568dc17a29fc51
SHA1 c855b80481d0a26c6e184f41868e93d236a07176
SHA512 5affc783ee55b0ee4b2a01e0a1b27a97277a19a23eb5d58eca3475e6fb0f2e82b23703b7ec3385f7592aab89c83084027b6e4eb74644b4f1192cc395b9a6b08e
TLSH
T1E0B01201D2F114EE5DD41C0A911424406BCFC254138C4B3E84002D50F0AA7FC827D7FC
MD5 SHA1 SHA512 TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_95fc489d41bc4a048edca698f00e0b68\Browsers\Firefox\dzn6qwxz.default-release\History.txt
Size 329B
SHA256 b2d2ed58102a2e745b3c6f4f4efcf14d75d7540998cbf5507e8acfe382c06a83
MD5 e8594fd55f81368f6ea1942fa64fa165
SHA1 a0af136530076f14856869b2d49477d23ffa7da1
SHA512 2b8a989da55c0b75c56ccb0c6771c199908b76474552a6288112383de3c4a4f22d5025a5bb1c86d4684d212c78fbf043f661a4ea76111c77e2c80717290bf4ab
TLSH
T15EE07DA3707232681F05CE3570197A5964C3C33ABDE910EFF046383091F87B092F4148
MD5 SHA1 SHA512 TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_be13784978c84007bcd1b9746cb170ae\Information.txt
Size 286B
SHA256 2fd1f604e9d0bddfce617760438d19334a193d1512ffe6f27eedac05a67b26b2
MD5 5f6497e52b19d796b286c7d0b2269c99
SHA1 0e1191a5d0b7b39d8dc15c2147ea70876dfb3ddf
SHA512 fd8ee98e3478afbf2c2cb0e5e46a0c224afd8119ce22c8f15c249b944fdcd8a43510be273ef1e78bed2c1ff20ad9a16879ddeac780ba4890a591ce6894753c4d
TLSH
T1C4D02B70C35E0C0E51E9217F0306332360FDE08331A94AEC7CDD82A6BC570C0A915A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Information.txt

Path C:\Users\Admin\AppData\Local\Temp\antarctida_pack_e62fa7389ebc4336acb1a4d0bc2e6bc5\Information.txt
Size 273B
SHA256 c391e1b4a5c03213ac519e7099577a64a2994ba60c48bc851935183eea39ad08
MD5 d854960a08cb6a436b6b8686ff82ab5f
SHA1 d446b4d3a64b2c715fcefcd6bb105c870674b659
SHA512 e4f0544fdad7fe2b6cc109bda1d59872e3141b97a498de5abda674a024f7a9e34d4ac00edbd66e1933fd602246ba64bdebac2da084ce29116586c25605e41ba4
TLSH
T195D02B70831E0C0E50E8117B0306331301EAD093116509EC7CDE51B3B958080656099E
MD5 SHA1 SHA512 TLSH

Submit Download

e1164b289bc14968b255351d2f99cf31.bat

Path C:\Users\Admin\AppData\Local\Temp\e1164b289bc14968b255351d2f99cf31.bat
Size 128B
SHA256 9c2defbf10cf766336639602ce33f8e89a35ce81ca8733e00ec3f1e7207c60cd
MD5 41593c220e537b4d3c0a5e0c1e4b9006
SHA1 0e043855538cd4c190554e57ddb3267a42b8abb0
SHA512 c14afef4bac6861dce2cefcc9e79ef38c9572ecc8a23819710b3f1b24b45e80efaa9f905ace04ca7319c25c2ef16d40eabb93f3878336c0b83f6d0b5e6b59022
TLSH
T138B02B1A3255C3CF140610E10AAF2044007EC0C15A00B4460101407E8345036B513CC2
MD5 SHA1 SHA512 TLSH

Submit Download

ee2bdde3c04f4ba9a25b8b0bf8665d97.bat

Path C:\Users\Admin\AppData\Local\Temp\ee2bdde3c04f4ba9a25b8b0bf8665d97.bat
Size 128B
SHA256 016ec9147d54ccc251066c31426d804105f9f033797c0e62eabcc6db3d6bc80e
MD5 ae2859ab89d1af9ecd46fbb3be6aa782
SHA1 a79b6d3e057b4409d9d30dfb59fb89f890a34b2c
SHA512 7f2d430044fb582dd092407e3d5ceff6a2c29c9af7b8c0b8ca5fab10e521e708458244311c2396dcbc64a0a4da91888d6733d54bbb4473edf69a07c7790fdf55
TLSH
T123B09B2631D947DD140110F24ABF2185106E51C559055486464A84BEC5A54375457DC6
MD5 SHA1 SHA512 TLSH

Submit Download

f39c8d2da5e94da4b79e6e571176967d.bat

Path C:\Users\Admin\AppData\Local\Temp\f39c8d2da5e94da4b79e6e571176967d.bat
Size 128B
SHA256 6aeeed649bbc1f5bc0fb0635b393d0dd5985eaaa5e9b0408bad9f70eebafb0e8
MD5 95fa13011cbd14ffbd5b34d1e37fc8e4
SHA1 7c0b1c5edf0ddb3138cddae601be13882aaf5003
SHA512 c676946d69d00c97de8d4ad0a7065ee7fb91db89b7144c3853d66c873aa5b8e438546ac65937dba35777e623e4fa388778f48ecb54bf07ed042926538e486f1c
TLSH
T156B02B22209F43CC150100F10ABF2040006FC4C1DD0060820241447E8149032A053CC1
MD5 SHA1 SHA512 TLSH

Submit Download

fabad7263acb4adca075d98293f3b5e3.bat

Path C:\Users\Admin\AppData\Local\Temp\fabad7263acb4adca075d98293f3b5e3.bat
Size 128B
SHA256 cc64ea6bda6eca31c9d5ff95010151e0d5f0ac983fe4bf9259a55841ac9aa674
MD5 aadf6342c4d5fbd7dff81b275bfac84f
SHA1 3509155c9d0223d9c5041a624a5c4f1aa58962f1
SHA512 f232b32d65f04aec8cec2e3e0d58d129afd5641d668ac786373d18afc675a9d5ab26a7d439991f8d386368509455e89ce073b894382d7081cf797762dfd90462
TLSH
T137B09B16217A47DD140510A147BF2646106F50C56D0454564645C4BE854D5369457DC6
MD5 SHA1 SHA512 TLSH

Submit Download

Antarctida_0f0n0usa9hh9.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_0f0n0usa9hh9.exe
Size 207KB
SHA256 3a25a60c336fec006fc0606fafa6f8e6bddbbd0ddac20f10f2ff26d0ccc0c323
MD5 80d53aabfdeab6f4173f1727a130f7f2
SHA1 18ab9256df84cd0a59bb286244dfd84c236eb3dc
SHA512 21fed50018bed756b97061a87e63424b179e71882b02624993bb6559c6ee6d14e56013fbf4c6a271c6ee2966a92d777a4d8daa50d81f99e55c79fca2e92aafd0
SSDEEP 6144:RWMNPEyvaRHKIB+nylmV6r0MabLxM03aAa:EMN8yvuluxM0qAa
TLSH
T1ED245D187AC94815E5AFCEB5E4EC60BA89BAE1732442F3431492D0761E527D0FE43DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_36yja3u37vnd.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_36yja3u37vnd.exe
Size 172KB
SHA256 e96411796d9227fd3283ae3024040969c5aa8e75ca74c96b7bd583181c5a29b1
MD5 91d343a51b71dc77bdfae41eaf54a41f
SHA1 a9a86e5279da1bca8c7415fcc71f08967d4c971f
SHA512 1a16672c1ccccfc6cd3770f1ff31aefa97bfa2fcac39ae151692aafcc6d70b5bba70cb3b355a5e669571e32c48ed776c49dbb92b3d151f2621dbe4c2b8246f85
SSDEEP 3072:gtiDQePEyv66TiRL3CY74tbAC/MbiLFzb9ee9R/MjFm6A1nQUb3zwv6oz:kiDNPEyv66TiRTt4JACUbiLdbZ9RkOu
TLSH
T126045D183BC98816E67FC9B4D4F860BA86BDE1732842F74718D6D4A61E127D0F902DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4an4gsa32giq.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4an4gsa32giq.exe
Size 240KB
SHA256 bdbc3a0f429386053fcf0e5e518b0481965209a50111790be07737911cac6b19
MD5 8742094c50688bddafc951af70a75eeb
SHA1 42b78c7e6db9bf710aee42f2a56f54cc79dabef2
SHA512 3ee3f0c2f03444526cc2475d2ffbea41d532e5573dfe44fe469485cda2dfb52f936f0e6f640c2e694e7e71d5d2a5b33e6d31be4fecadb496960eea235b6f3c81
SSDEEP 6144:8iVNPEyv66TiRTtPqSy+qmaIx+jPbyHRnBAlhDKOT:5VN8yv6ly+ZAURnK/DKOT
TLSH
T167344C197AC94815D96FCAB9D8EC60BF86BDA1736482F3471492E1760E523D0FE02C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4b6yp3in9wwp.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4b6yp3in9wwp.exe
Size 227KB
SHA256 e5ffea3134f5126b4195a530e4a28dc0520ed18ef0d00f0e350a281ccab39f0d
MD5 d1d89f83c8e9cf1f0c79a2dad3b75482
SHA1 6412f05c7c945539b9a0f328605eb9806a3933d1
SHA512 9633222190040d6fd7e8cb188062ae4290b334b35628fe1e7f313ef9b8de48890f1d6268fc2819cc383792b453a87ab04184a0d9ca6bff892c3950fdb9b4ecd1
SSDEEP 6144:vWyNPEyvaRHKIB+n2KAnauBy6bYPdpO98JHBQ8:eyN8yvuXKSBAVpO9uH28
TLSH
T17D344B287AC94811D5AF9EB4D8EC60BA89BEE1732442F3475592D0761E127D0FE43CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_4ofb6rsmmild.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_4ofb6rsmmild.exe
Size 203KB
SHA256 a77fc064d4fe0887420458d603894d789b3feeabf9fc5fc21cd6fbc9c4648634
MD5 f34eb5e829e1035152dbe5cada25174d
SHA1 63c3d3e494e2e2d69814d99d65c570ebb54f0f01
SHA512 44894e4c7faa14ea2b36cb8060eb14c646c8527ec4b08d0892630a81a78ffd57b3058c33d53cf6ee3dc22f18b8d606fc15f5f3b2299f5f5ed3237cb3e727440c
SSDEEP 3072:ptinQePEyv66TiRL3CY7H+L/c0MnDlqQqzIifR8bktwP03lwA1bYatmb3zUv6oz:finNPEyv66TiRTtH+oBDlJqcDbbPwTV
TLSH
T12F146C187AC94815D66FCAB9D8E820BA85BDE1736882F74714D2D0B61E427D0FE43CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_6mz21cxhs1tu.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_6mz21cxhs1tu.exe
Size 184KB
SHA256 c8093ac5e18312984e2bb979c7a616220aa0af747ea8d8dd0f96d8458b32d98c
MD5 4e7ee04ccddd415902cbb5c391aaa788
SHA1 0120bf5bceff75a3a2642a337daee1f3815f5156
SHA512 452dd4d7855cbe340dc9d9de0741eb6e1d37d1b47f860d8779d66a1c01c2447ccfcaaccca5f67f03d7bc70cd304169f59b71f62795c0a87d217b9ad233050386
SSDEEP 3072:PtitQePEyv66TiRL3CY76eSJtMViDwGwbk0mKWA1Xhcib3zBv6oz:1itNPEyv66TiRTt6eSHMVsebXHZcC
TLSH
T177045C287AC94906E67FCDB5D8E860B989BDE1732842F3531892D0B61E127D0FD42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_bya0g4vx2i0d.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_bya0g4vx2i0d.exe
Size 177KB
SHA256 a99e493365f8e586d2207b6e2bcf4e1e6dd2a6406cf1d4bc46ddfc389aa30cc7
MD5 6bde6f5cca68f5247787a185c88298ce
SHA1 c44a57467fd966d3b46d6d4fff928c7561daf545
SHA512 7d054b13ccb1b958bf2165af4b4472462271a4faf78a7f2a916e1891912a6254d7881546a20391046c3ba902780cf520fe62bff4771650efd6ff364abba4dca7
SSDEEP 3072:dtiEQePEyv66TiRL3CY7CA7UtaffJobEBpTA3L8wdE5A1iiVb3zDv6oz:jiENPEyv66TiRTtLQcBobSpTAbbJn
TLSH
T1F6046C283AC84D06E66F8D75D4B860BA89BDE1772843F3572897D0B61E527D0ED02CB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_d3pdc7owpdt0.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_d3pdc7owpdt0.exe
Size 207KB
SHA256 423183a9aebd800cc39bb6e7dba1389a6bfa59a37207e04ffd78447da8f2c4e3
MD5 93ce87c8068dcb8bc59643fbfe831114
SHA1 585e1a014130fba41b25e90c6a1277e2d9a54d87
SHA512 0872fd3346b87038d8d46fe4e6f690edb64d121502248242938b33b3ecc6f917b06951de97049fa1ae5a326ebdb48469fe48a4be65564d49ebb01423e899435d
SSDEEP 3072:ktinEQePEyv66TiRL3CY7aLD+92UOvoVwCtCs8Kbau6RoUwA1h7kb3zOv6oz:IinENPEyv66TiRTtaLb5voVwC46bWJF
TLSH
T1B8246C197AC95916D56F8AB8D8EC20BB8AB9E1731882F75314E2D0B61E127D0FD03C77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_dp9hittxyh5a.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_dp9hittxyh5a.exe
Size 230KB
SHA256 fd085925ba59d5281333798ce6ab54d5925fa7f007840e26e2c1dfdc5cdca860
MD5 2cf8d7664b982d667a4e326f56e96470
SHA1 7cf3f4c04887e8019ba0137355a396c78f674b4a
SHA512 c4f1ac141c295771a67a3b6b39a37ae2ebc9045001e57af782fb4fee6227b657ae81f8e799832697cc4dd117c62859e934b6f806e42f0d5b5c4939d983c78da8
SSDEEP 6144:ui9NPEyv66TiRTtN/1kOJqYXf5OShbYDuwWtPzg:L9N8yv6stDuwkzg
TLSH
T1C8344B287AC94816D57F8AB5D4EC60BA85BDE1732982F3471992E0760E127D0FE03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_gq1rwsnehpvx.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_gq1rwsnehpvx.exe
Size 189KB
SHA256 9d5ebd631e9d4353673f6c9905fad5882303280c2d02b2dcb2e8439c55074517
MD5 4197e47d6e3f588aa16f0af89e4f7d2b
SHA1 c3b08930e751fbe095a3136cbac69514f8e5588a
SHA512 52676424f748ff4a3c1368687167cd00d3f09058f25aeb077ea02360cedf26d1d517a4721a217135e0ebff89929c94b996b2c9f936913e4b1aa9c63bc5295fba
SSDEEP 3072:JtiFQePEyv66TiRL3CY79UsglToQF2BfEGgGhHbEkOoSVrA1xSb3zov6oz:/iFNPEyv66TiRTt2sglToQF2B8QHbBOO
TLSH
T1D8145D283BC84915D5AF89B4D8E860BA86B9E1732842F74318D7D0B61E527D0FE43DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_hbdsvcrfkokj.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_hbdsvcrfkokj.exe
Size 228KB
SHA256 a8a2507a3c6ec04cddc9500a40aba5325ef21a033d6f2c6a531eb2fe3df7e1b6
MD5 ba419328e6d8292c9eec287c2b108cfb
SHA1 3da5822c54eed032022371b567220c0530fb60ff
SHA512 389941c069a04d17a4d5d6c3633b1ce99d65ff7ad95ee3d918da6e7610dfc7b08d795a5e61e6b994ff7bcd17590dc6e97119e644baeff97fc5168520fc8904d4
SSDEEP 6144:ziaNPEyv66TiRTt9L9h3TiAmBVfbX+eUbfNg:maN8yv6lK7+De
TLSH
T1E5344B187AC94816DABFCAB4D4E860BB8ABEE1735446F3471492D0761E127D0FE42C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_hibu6njb1hbs.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_hibu6njb1hbs.exe
Size 170KB
SHA256 ad0126922e559411dc0231cfd317eec303348a8067e2f4f78eeb0cfb5695c1bc
MD5 ca5713bb72b624e2f3ac6359c6549f1f
SHA1 8123f133f5f5b40f0e8bf60e7f9b71d94cbd285b
SHA512 fdaedcec4e625c4156c5d6f908781e6bb7cebac630ba88f9d8c23fbfdbf82e692ba8b7419bf91b4e290436e834f106d251fa70540cfbf377c76a82034ded0a1b
SSDEEP 3072:HtiPQePEyv66TiRL3CY7d4t/eHN1BsbIrv2h4bA1UK5b3zSv6oz:NiPNPEyv66TiRTt88NobovbYQ
TLSH
T1F1045B283BC84D16D2AFC974D8B860B986B9E1772942F7532CD3D0A51E127D0EA42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_icmln5soaajv.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_icmln5soaajv.exe
Size 223KB
SHA256 5addffef6a7f1b6279b64b0d3979dc98f60b7719696608f204ffeff748922fc3
MD5 626ae6a508833d92439ab30e8141446b
SHA1 add936d695e7910f8d14ed97391bab01e8e6f26b
SHA512 1714120a1567b3d4b049691af970713cdb0876388faa6c1324761788c7eee64eece7f13c52b85ba519539c43dda29ecacb55d7049e9483c6fa552eb72b7a4d0e
SSDEEP 6144:pioNPEyv66TiRTtdm+3Poh4L1sSb52jxjb:MoN8yv6XSW1sA0jb
TLSH
T1E9245C187AC94816D96FCEB5D4E860BA85BEE0772582F3471492D1B61E427D0FE03CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_jzu9wque3pea.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_jzu9wque3pea.exe
Size 176KB
SHA256 40bd57bcac2ee4ebada7151f06613b75a0f3a9157aa937424f5de0ab08802b4d
MD5 fbde08e0bdebcdf1dd57b3ffc4dfcbe8
SHA1 f064be6c466cd8fab263ed48ebe427a9305cd598
SHA512 1be8cf9f1e074c736c50292fe1b70b4f3202b2c5ea34a7fff23cf743ba0266a83cd66e8acc6f8961c10a045450839eb0325771ba99a9c2669da54da8ab8e72c0
SSDEEP 3072:fti8QePEyv66TiRL3CY77iaIVZLF48351RFfKZb7L9OM1A1EmOeb3zJv6oz:li8NPEyv66TiRTt7i7VZL2g3Rhcbn9J8
TLSH
T1FB045C283BC84D06D67FC975D4B860B98AB9E2772843F74328D6D0A61E127D0BD42DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_n6tli5ilipd4.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_n6tli5ilipd4.exe
Size 199KB
SHA256 23d0c89d7cb13d3e1affcbabec988ab8a3c55fc99651196b3e50e3d860a03a57
MD5 2d0d4de998fba63e6140aa62481b8cd5
SHA1 330172cc30a3e71c1040a040d8f8b69947f1eb42
SHA512 71bb1e17a4fe0b344fd24635cee4c5f8f7449a46d2c095965ea866918b04ab3184f63a7c15243d271997c4b0f84b8fbd0b25574b4da4560e6a71ffe1258f3e8d
SSDEEP 6144:5WJNPEyvaRHKIB+n9BqnC8HZGFab//SK:sJN8yvuSQCo8SF
TLSH
T119145C187AC94C06E67F8AB5D4E864BA86B9E0732543F7531892D0B61E127D0FE03DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_o2l7d9lw3q3m.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_o2l7d9lw3q3m.exe
Size 239KB
SHA256 f35f10dc72d89beb3fd8220a0870befd9cd3f6541ae00e1494c3dc6a51f75869
MD5 a07206416beb4456bf17af4811197025
SHA1 9e28baab19eccd162a36d7d855983a2192b4172e
SHA512 92ec86f8898ab8e83afd18036edfbfa039b3381a6169e84700391492030087b3c8b06c68a4b746c554331b116470b52356282c67c9b7ff253cba023fc386bbfd
SSDEEP 6144:Wi4NPEyv66TiRTtefAf+xS+f00PDFCbgmscAubQYhfm0CDOp4:D4N8yv6+A8f00PDFCbgmsDYh3Ca+
TLSH
T1B0345C197EC94812E97FCAB5D4EC60AB8ABDA1731482F3471592D0761E527D0FE02CBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_qhxavz3ez0bs.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_qhxavz3ez0bs.exe
Size 175KB
SHA256 4b8ecafbe1f84db871d259d73fa1dd0055228fb3345f085d220f91745baf49f2
MD5 580006723ca7ca65345e4899bac752c6
SHA1 59cbd925e08465bdac3b01343a4d08569ca324ae
SHA512 5bb50214eff7b63933c4167f22ec69566328c8dfa78d6ff954562a67e80fd3b078c31150c84d2adeca8f891e4d706dbe3254a5b0ad333609e0b37f892b90fde7
SSDEEP 3072:WtiGOQePEyv66TiRL3CY7dQwHQsWoGY4GbncvDMypgA19b3zvv6oz:CiGONPEyv66TiRTt7HQfvGbnOgypF
TLSH
T1E4046C283BC98912D27F8DB5D4B860FA86B9E1772842F75718D2D0A61E127D0FD02DB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_sppw59vmzljt.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_sppw59vmzljt.exe
Size 211KB
SHA256 3967f801f18324a01933ca03b7d4628c27d297af4a3bdbbd5a51131492a767df
MD5 78f021af3fd8c5deba1166ee8ad1f06a
SHA1 3a98eca462f51ab2b99694d8ed44ac5867e9705a
SHA512 120722a436272257555726ee0adac6bf36ce1d92f7fff1baf7d18f6e96a727561a80cc8aef7151a420679ea6a2016a31d81432ed0654297e0b00e45305045558
SSDEEP 6144:sWANPEyvaRHKIB+nP99GJTtNZbqNh4mqnRBs:xAN8yvu0blN6RBs
TLSH
T1CC245D187AC94912E67FCEB5D9E860BA89B9E1732442F3571492D1B60E127D0FE03C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_wa65fg57rx04.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_wa65fg57rx04.exe
Size 199KB
SHA256 3b2af84654368e72b40738d1850c9ee20885444c3f7bbe0292a62c0583cd1fad
MD5 764bb84e5075de30648b2d9f7e714ea7
SHA1 3a2470e7df50d1077675fabaa82202700410b48d
SHA512 c2e7467001b77f0db72b452611c4c6d55a7155fb0fd71283861fdebbda3a9fe1a091526bbd9a19a98396169a7179970ca5abb5f226243f495457245af389a3dd
SSDEEP 6144:liZMNPEyv66TiRTtOr6ZJ4jhfnKQXYbVSiC7CBgX:gaN8yv6RFQ0SRuBgX
TLSH
T19A146C1C7AC94815D5AFCAB5D4F860BA86BEE1732442F3432492D5A61E523D0FE03DBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Antarctida_yn62z54msax0.exe

Path C:\Users\Admin\AppData\Roaming\Antarctida_yn62z54msax0.exe
Size 237KB
SHA256 03a33474e3662fab79c330da66df99a9186120a766fb4420ad42d64b01eec2df
MD5 8223382ba58f254368530a469745dab1
SHA1 fa790c2d3f8dd8b1468550ea1bbd398add68d72d
SHA512 fe9aee1b492ae49d326d23f548054967a2c1434d5ea3bc052e53c9e54c970547ad1a27b1ca0b91cc46985322c508d57a076df1b9b51547122f83625bc5825014
SSDEEP 6144:0iYNPEyv66TiRTtyHzY3T4SSbERJ0XfiQjt:BYN8yv66zY3T4ok6Qh
TLSH
T1C7344A297AC94812D9AF8EB5D8EC60BA85BEA1731482F3471592D0761F427D0FE03D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-272-0x0000000000360000-0x00000000003A2000-memory.dmp

Download

memory/1528-231-0x0000000000AB0000-0x0000000000AE2000-memory.dmp

Download

memory/1752-316-0x0000000000B70000-0x0000000000BA8000-memory.dmp

Download

memory/1800-216-0x00000000005E0000-0x000000000061E000-memory.dmp

Download

memory/1836-247-0x00000000002F0000-0x0000000000328000-memory.dmp

Download

memory/1988-178-0x0000000000DB0000-0x0000000000DEE000-memory.dmp

Download

memory/2044-233-0x00007FF86F430000-0x00007FF86FDD4000-memory.dmp

Download

memory/2044-5-0x00007FF86F430000-0x00007FF86FDD4000-memory.dmp

Download

memory/2044-338-0x00007FF86F430000-0x00007FF86FDD4000-memory.dmp

Download

memory/2044-0-0x00007FF86F5BF000-0x00007FF86F5C0000-memory.dmp

Download

memory/2044-1-0x00000000007F0000-0x0000000000A08000-memory.dmp

Download

memory/2044-2-0x00007FF86F430000-0x00007FF86FDD4000-memory.dmp

Download

memory/2044-184-0x00007FF86F430000-0x00007FF86FDD4000-memory.dmp

Download

memory/2128-56-0x0000000000880000-0x00000000008B8000-memory.dmp

Download

memory/2128-119-0x0000000006460000-0x0000000006A1A000-memory.dmp

Download

memory/2128-254-0x0000000006A90000-0x0000000006AF6000-memory.dmp

Download

memory/2144-132-0x0000000000C80000-0x0000000000CBA000-memory.dmp

Download

memory/2268-166-0x0000000000120000-0x0000000000154000-memory.dmp

Download

memory/3260-117-0x0000000005B20000-0x0000000005BB2000-memory.dmp

Download

memory/3260-30-0x0000000000590000-0x00000000005CA000-memory.dmp

Download

memory/3260-28-0x00000000742F2000-0x00000000742F3000-memory.dmp

Download

memory/3260-240-0x00000000742F2000-0x00000000742F3000-memory.dmp

Download

memory/3452-146-0x00000000005E0000-0x000000000061E000-memory.dmp

Download

memory/3908-286-0x00000000009E0000-0x0000000000A12000-memory.dmp

Download

memory/4068-82-0x00000000009E0000-0x0000000000A14000-memory.dmp

Download

memory/4304-40-0x00000000001C0000-0x00000000001FE000-memory.dmp

Download

memory/4304-46-0x0000000004B30000-0x0000000004B42000-memory.dmp

Download

memory/4304-45-0x0000000004B00000-0x0000000004B0A000-memory.dmp

Download

memory/4532-196-0x00000000001F0000-0x0000000000220000-memory.dmp

Download

memory/4684-305-0x0000000000490000-0x00000000004CA000-memory.dmp

Download

memory/5772-95-0x0000000000710000-0x0000000000740000-memory.dmp

Download

memory/5836-59-0x0000000005F90000-0x0000000005FE0000-memory.dmp

Download

memory/5836-41-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/5836-461-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/5836-38-0x0000000000D80000-0x0000000000DC2000-memory.dmp

Download

memory/5836-241-0x00000000742E0000-0x0000000074A9C000-memory.dmp

Download

memory/6004-112-0x0000000000A80000-0x0000000000AB2000-memory.dmp

Download

memory/6308-327-0x00000000005A0000-0x00000000005E0000-memory.dmp

Download

memory/6916-337-0x0000000000140000-0x0000000000182000-memory.dmp

Download