debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 1.1MB
Sample260703-e5d9yabv4s
SHA256 debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969
MD5 0c273b22168a2610fc95af914b33c8cd
SHA1 cacf9c538b34779431ea54764d89f96489feed79
SHA512 cd197cc20a2078226876cde0ea5fb091cc1f1c933d50bf5626fd51c39319d8b02032fdffc66364a58abac6739eb82bdd4b105013c7c0b67f7f49121dd1f418c2
SSDEEP 12288:4DtRRdC4rGDHNEkkvaXs3HOD/5y2V7/WmGdctZpFiDjeats8MwWPAcI45s/Mu:XHNTkCXm2VqmGdcjp7d8MwWvI45m
TLSH
T104451901A6E402A8E1B7D774DE7B5845E777B94A0730E9DF0294955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution spyware stealer upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.nirsoft.net/utils/browserdownloadsview.zip

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.nirsoft.net/utils/executedprogramslist.zip

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.nirsoft.net/utils/recentfilesview.zip

Signatures

Detected Nirsoft tools 12 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x00080000000244a4-79.dat	Nirsoft
behavioral1/memory/4864-99-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/432-103-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/4864-107-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/432-111-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1512-116-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/3040-123-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/4032-130-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/4128-137-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1996-146-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1576-155-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/4992-161-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024487-31.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244a8-97.dat	UPX
behavioral1/memory/4864-99-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/432-103-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/4864-107-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/432-111-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/1512-116-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/3040-123-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/4032-130-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/4128-137-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/1996-146-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/1576-155-0x0000000000400000-0x0000000000417000-memory.dmp	UPX
behavioral1/memory/4992-161-0x0000000000400000-0x0000000000417000-memory.dmp	UPX

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	3612	powershell.exe
44	4276	powershell.exe
45	2512	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe

Executes dropped EXE 33 IoCs

pid	Process
3812	BrowserDownloadsView.exe
208	BrowserDownloadsView.exe
464	BrowserDownloadsView.exe
4224	BrowserDownloadsView.exe
312	BrowserDownloadsView.exe
2528	BrowserDownloadsView.exe
2292	BrowserDownloadsView.exe
3980	ExecutedProgramsList.exe
4864	RecentFilesView.exe
432	RecentFilesView.exe
3184	BrowserDownloadsView.exe
1624	ExecutedProgramsList.exe
1512	RecentFilesView.exe
3776	ExecutedProgramsList.exe
4328	BrowserDownloadsView.exe
1108	ExecutedProgramsList.exe
2604	BrowserDownloadsView.exe
3040	RecentFilesView.exe
4032	RecentFilesView.exe
4680	ExecutedProgramsList.exe
1632	BrowserDownloadsView.exe
4128	RecentFilesView.exe
2008	ExecutedProgramsList.exe
4344	BrowserDownloadsView.exe
1996	RecentFilesView.exe
3976	ExecutedProgramsList.exe
4568	BrowserDownloadsView.exe
1576	RecentFilesView.exe
772	ExecutedProgramsList.exe
1276	BrowserDownloadsView.exe
4992	RecentFilesView.exe
2864	ExecutedProgramsList.exe
1260	BrowserDownloadsView.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000244a8-97.dat	upx
behavioral1/memory/4864-99-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/432-103-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/4864-107-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/432-111-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1512-116-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/3040-123-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/4032-130-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/4128-137-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1996-146-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1576-155-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/4992-161-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3612	powershell.exe
1176	powershell.exe
3424	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3612	powershell.exe
3612	powershell.exe
1176	powershell.exe
1176	powershell.exe
4276	powershell.exe
4276	powershell.exe
2512	powershell.exe
2512	powershell.exe
3424	powershell.exe
3424	powershell.exe
3424	powershell.exe
3612	powershell.exe
3612	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 12 IoCs

pid	Process
3812	BrowserDownloadsView.exe
464	BrowserDownloadsView.exe
4224	BrowserDownloadsView.exe
312	BrowserDownloadsView.exe
2528	BrowserDownloadsView.exe
3184	BrowserDownloadsView.exe
4328	BrowserDownloadsView.exe
2604	BrowserDownloadsView.exe
1632	BrowserDownloadsView.exe
4568	BrowserDownloadsView.exe
1276	BrowserDownloadsView.exe
1260	BrowserDownloadsView.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3612	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	3612	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 3192	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	86
PID 4368 wrote to memory of 2312	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	87
PID 4368 wrote to memory of 4632	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	89
PID 4368 wrote to memory of 1488	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	92
PID 4368 wrote to memory of 3612	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 4368 wrote to memory of 1128	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	96
PID 4368 wrote to memory of 1176	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	98
PID 4368 wrote to memory of 3812	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 4368 wrote to memory of 208	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	101
PID 4368 wrote to memory of 464	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	107
PID 4368 wrote to memory of 4224	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	111
PID 4368 wrote to memory of 312	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	112
PID 4368 wrote to memory of 2528	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	113
PID 4368 wrote to memory of 2292	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	114
PID 4368 wrote to memory of 1264	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	115
PID 4368 wrote to memory of 1984	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	117
PID 4368 wrote to memory of 4276	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	119
PID 4368 wrote to memory of 2512	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	121
PID 4368 wrote to memory of 1596	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	123
PID 4368 wrote to memory of 3424	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	125
PID 4368 wrote to memory of 548	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	127
PID 4368 wrote to memory of 3980	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	129
PID 4368 wrote to memory of 3612	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	130
PID 4368 wrote to memory of 4864	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	132
PID 4368 wrote to memory of 432	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	133
PID 4368 wrote to memory of 3184	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	134
PID 4368 wrote to memory of 1624	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	135
PID 4368 wrote to memory of 1512	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	136
PID 4368 wrote to memory of 3776	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	137
PID 4368 wrote to memory of 4328	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	138
PID 4368 wrote to memory of 1108	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	139
PID 4368 wrote to memory of 2604	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	140
PID 4368 wrote to memory of 3040	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	141
PID 4368 wrote to memory of 4032	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	143
PID 4368 wrote to memory of 4680	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	144
PID 4368 wrote to memory of 1632	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	145
PID 4368 wrote to memory of 4128	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	146
PID 4368 wrote to memory of 2008	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	147
PID 4368 wrote to memory of 4344	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	148
PID 4368 wrote to memory of 3976	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	149
PID 4368 wrote to memory of 1996	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	150
PID 4368 wrote to memory of 4568	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	151
PID 4368 wrote to memory of 1576	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	152
PID 4368 wrote to memory of 772	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	153
PID 4368 wrote to memory of 1276	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	154
PID 4368 wrote to memory of 4992	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	155
PID 4368 wrote to memory of 2864	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	156
PID 4368 wrote to memory of 1260	4368	2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe	157

C:\Users\Admin\AppData\Local\Temp\2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
  2⤵
  PID:3192
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
  2⤵
  PID:2312
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
  2⤵
  PID:4632
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
  2⤵
  PID:1488
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAHQAbwBwACcAOwAgAHQAcgB5ACAAewAgAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAHQAcgB5ACAAewAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgACQAdQByAGwAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AaQByAHMAbwBmAHQALgBuAGUAdAAvAHUAdABpAGwAcwAvAGIAcgBvAHcAcwBlAHIAZABvAHcAbgBsAG8AYQBkAHMAdgBpAGUAdwAuAHoAaQBwACcAOwAgACQAbwB1AHQAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAbwB3AG4AbABvAGEAZABzAFwAaABvAGwAeQBjAGgAZQBjAGsAXAAcBDsELgBBBD4EQgRABEMENAQ9BDgEOgRcAGIAcgBvAHcAcwBlAHIAZABvAHcAbgBsAG8AYQBkAHMAdgBpAGUAdwAuAHoAaQBwAC4AcABhAHIAdAAnADsAIAAkAHUAYQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAxADIANAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAOwAgAHQAcgB5ACAAewAgACQAaABhAG4AZABsAGUAcgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgA7ACAAJABoAGEAbgBkAGwAZQByAC4AQQBsAGwAbwB3AEEAdQB0AG8AUgBlAGQAaQByAGUAYwB0AD0AJAB0AHIAdQBlADsAIAAkAGMAbABpAGUAbgB0AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASAB0AHQAcABDAGwAaQBlAG4AdAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAGgAYQBuAGQAbABlAHIAOwAgACQAYwBsAGkAZQBuAHQALgBUAGkAbQBlAG8AdQB0AD0AWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoARgByAG8AbQBTAGUAYwBvAG4AZABzACgAMwAwADAAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AVQBzAGUAcgBBAGcAZQBuAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAkAHUAYQApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AbwBjAHQAZQB0AC0AcwB0AHIAZQBhAG0AJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAAJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAKgAvACoAJwApADsAIAAkAHIAZQBzAHAAPQAkAGMAbABpAGUAbgB0AC4ARwBlAHQAQQBzAHkAbgBjACgAJAB1AHIAbAAsAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbwBtAHAAbABlAHQAaQBvAG4ATwBwAHQAaQBvAG4AXQA6ADoAUgBlAHMAcABvAG4AcwBlAEgAZQBhAGQAZQByAHMAUgBlAGEAZAApAC4ARwBlAHQAQQB3AGEAaQB0AGUAcgAoACkALgBHAGUAdABSAGUAcwB1AGwAdAAoACkAOwAgACQAcgBlAHMAcAAuAEUAbgBzAHUAcgBlAFMAdQBjAGMAZQBzAHMAUwB0AGEAdAB1AHMAQwBvAGQAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHMAdAByAGUAYQBtAD0AJAByAGUAcwBwAC4AQwBvAG4AdABlAG4AdAAuAFIAZQBhAGQAQQBzAFMAdAByAGUAYQBtAEEAcwB5AG4AYwAoACkALgBHAGUAdABBAHcAYQBpAHQAZQByACgAKQAuAEcAZQB0AFIAZQBzAHUAbAB0ACgAKQA7ACAAJABmAGkAbABlAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAG8AdQB0ACwAWwBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoAQwByAGUAYQB0AGUALABbAEkATwAuAEYAaQBsAGUAQQBjAGMAZQBzAHMAXQA6ADoAVwByAGkAdABlACwAWwBJAE8ALgBGAGkAbABlAFMAaABhAHIAZQBdADoAOgBOAG8AbgBlACkAOwAgACQAYgB1AGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADAANAA4ADUANwA2ADsAIAB0AHIAeQAgAHsAIAB3AGgAaQBsAGUAIAAoACgAJAByAGUAYQBkAD0AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmACwAMAAsACQAYgB1AGYALgBMAGUAbgBnAHQAaAApACkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGYAaQBsAGUALgBXAHIAaQB0AGUAKAAkAGIAdQBmACwAMAAsACQAcgBlAGEAZAApACAAfQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAZgBpAGwAZQAuAEMAbABvAHMAZQAoACkAOwAgACQAcwB0AHIAZQBhAG0ALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAbABpAGUAbgB0AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAGkAZgAgACgAJAByAGUAcwBwACkAIAB7ACAAJAByAGUAcwBwAC4ARABpAHMAcABvAHMAZQAoACkAIAB9ACAAfQAgAGUAeABpAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB0AHIAeQAgAHsAIAAkAHcAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1AGEAKQA7ACAAJAB3AGMALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAnAEEAYwBjAGUAcAB0ACcALAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAG8AYwB0AGUAdAAtAHMAdAByAGUAYQBtACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAALAAqAC8AKgAnACkAOwAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBBAGMAYwBlAHAAdAAtAEwAYQBuAGcAdQBhAGcAZQAnACwAJwByAHUALQBSAFUALAByAHUAOwBxAD0AMAAuADkALABlAG4ALQBVAFMAOwBxAD0AMAAuADcALABlAG4AOwBxAD0AMAAuADYAJwApADsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACQAbwB1AHQAKQA7ACAAZQB4AGkAdAAgADAAIAB9ACAAYwBhAHQAYwBoACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
  2⤵
  PID:1128
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3812
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:208
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:464
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4224
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:312
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2528
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2292
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
  2⤵
  PID:1264
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
  2⤵
  PID:1984
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAHQAbwBwACcAOwAgAHQAcgB5ACAAewAgAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAHQAcgB5ACAAewAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgACQAdQByAGwAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AaQByAHMAbwBmAHQALgBuAGUAdAAvAHUAdABpAGwAcwAvAGUAeABlAGMAdQB0AGUAZABwAHIAbwBnAHIAYQBtAHMAbABpAHMAdAAuAHoAaQBwACcAOwAgACQAbwB1AHQAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAbwB3AG4AbABvAGEAZABzAFwAaABvAGwAeQBjAGgAZQBjAGsAXAAcBDsELgBBBD4EQgRABEMENAQ9BDgEOgRcAGUAeABlAGMAdQB0AGUAZABwAHIAbwBnAHIAYQBtAHMAbABpAHMAdAAuAHoAaQBwAC4AcABhAHIAdAAnADsAIAAkAHUAYQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAxADIANAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAOwAgAHQAcgB5ACAAewAgACQAaABhAG4AZABsAGUAcgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgA7ACAAJABoAGEAbgBkAGwAZQByAC4AQQBsAGwAbwB3AEEAdQB0AG8AUgBlAGQAaQByAGUAYwB0AD0AJAB0AHIAdQBlADsAIAAkAGMAbABpAGUAbgB0AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASAB0AHQAcABDAGwAaQBlAG4AdAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAGgAYQBuAGQAbABlAHIAOwAgACQAYwBsAGkAZQBuAHQALgBUAGkAbQBlAG8AdQB0AD0AWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoARgByAG8AbQBTAGUAYwBvAG4AZABzACgAMwAwADAAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AVQBzAGUAcgBBAGcAZQBuAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAkAHUAYQApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AbwBjAHQAZQB0AC0AcwB0AHIAZQBhAG0AJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAAJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAKgAvACoAJwApADsAIAAkAHIAZQBzAHAAPQAkAGMAbABpAGUAbgB0AC4ARwBlAHQAQQBzAHkAbgBjACgAJAB1AHIAbAAsAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbwBtAHAAbABlAHQAaQBvAG4ATwBwAHQAaQBvAG4AXQA6ADoAUgBlAHMAcABvAG4AcwBlAEgAZQBhAGQAZQByAHMAUgBlAGEAZAApAC4ARwBlAHQAQQB3AGEAaQB0AGUAcgAoACkALgBHAGUAdABSAGUAcwB1AGwAdAAoACkAOwAgACQAcgBlAHMAcAAuAEUAbgBzAHUAcgBlAFMAdQBjAGMAZQBzAHMAUwB0AGEAdAB1AHMAQwBvAGQAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHMAdAByAGUAYQBtAD0AJAByAGUAcwBwAC4AQwBvAG4AdABlAG4AdAAuAFIAZQBhAGQAQQBzAFMAdAByAGUAYQBtAEEAcwB5AG4AYwAoACkALgBHAGUAdABBAHcAYQBpAHQAZQByACgAKQAuAEcAZQB0AFIAZQBzAHUAbAB0ACgAKQA7ACAAJABmAGkAbABlAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAG8AdQB0ACwAWwBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoAQwByAGUAYQB0AGUALABbAEkATwAuAEYAaQBsAGUAQQBjAGMAZQBzAHMAXQA6ADoAVwByAGkAdABlACwAWwBJAE8ALgBGAGkAbABlAFMAaABhAHIAZQBdADoAOgBOAG8AbgBlACkAOwAgACQAYgB1AGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADAANAA4ADUANwA2ADsAIAB0AHIAeQAgAHsAIAB3AGgAaQBsAGUAIAAoACgAJAByAGUAYQBkAD0AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmACwAMAAsACQAYgB1AGYALgBMAGUAbgBnAHQAaAApACkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGYAaQBsAGUALgBXAHIAaQB0AGUAKAAkAGIAdQBmACwAMAAsACQAcgBlAGEAZAApACAAfQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAZgBpAGwAZQAuAEMAbABvAHMAZQAoACkAOwAgACQAcwB0AHIAZQBhAG0ALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAbABpAGUAbgB0AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAGkAZgAgACgAJAByAGUAcwBwACkAIAB7ACAAJAByAGUAcwBwAC4ARABpAHMAcABvAHMAZQAoACkAIAB9ACAAfQAgAGUAeABpAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB0AHIAeQAgAHsAIAAkAHcAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1AGEAKQA7ACAAJAB3AGMALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAnAEEAYwBjAGUAcAB0ACcALAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAG8AYwB0AGUAdAAtAHMAdAByAGUAYQBtACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAALAAqAC8AKgAnACkAOwAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBBAGMAYwBlAHAAdAAtAEwAYQBuAGcAdQBhAGcAZQAnACwAJwByAHUALQBSAFUALAByAHUAOwBxAD0AMAAuADkALABlAG4ALQBVAFMAOwBxAD0AMAAuADcALABlAG4AOwBxAD0AMAAuADYAJwApADsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACQAbwB1AHQAKQA7ACAAZQB4AGkAdAAgADAAIAB9ACAAYwBhAHQAYwBoACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAHQAbwBwACcAOwAgAHQAcgB5ACAAewAgAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAHQAcgB5ACAAewAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgACQAdQByAGwAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AaQByAHMAbwBmAHQALgBuAGUAdAAvAHUAdABpAGwAcwAvAHIAZQBjAGUAbgB0AGYAaQBsAGUAcwB2AGkAZQB3AC4AegBpAHAAJwA7ACAAJABvAHUAdAA9ACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwARABvAHcAbgBsAG8AYQBkAHMAXABoAG8AbAB5AGMAaABlAGMAawBcABwEOwQuAEEEPgRCBEAEQwQ0BD0EOAQ6BFwAcgBlAGMAZQBuAHQAZgBpAGwAZQBzAHYAaQBlAHcALgB6AGkAcAAuAHAAYQByAHQAJwA7ACAAJAB1AGEAPQAnAE0AbwB6AGkAbABsAGEALwA1AC4AMAAgACgAVwBpAG4AZABvAHcAcwAgAE4AVAAgADEAMAAuADAAOwAgAFcAaQBuADYANAA7ACAAeAA2ADQAKQAgAEEAcABwAGwAZQBXAGUAYgBLAGkAdAAvADUAMwA3AC4AMwA2ACAAKABLAEgAVABNAEwALAAgAGwAaQBrAGUAIABHAGUAYwBrAG8AKQAgAEMAaAByAG8AbQBlAC8AMQAyADQALgAwACAAUwBhAGYAYQByAGkALwA1ADMANwAuADMANgAnADsAIAB0AHIAeQAgAHsAIAAkAGgAYQBuAGQAbABlAHIAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbABpAGUAbgB0AEgAYQBuAGQAbABlAHIAOwAgACQAaABhAG4AZABsAGUAcgAuAEEAbABsAG8AdwBBAHUAdABvAFIAZQBkAGkAcgBlAGMAdAA9ACQAdAByAHUAZQA7ACAAJABjAGwAaQBlAG4AdAA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAQwBsAGkAZQBuAHQAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJABoAGEAbgBkAGwAZQByADsAIAAkAGMAbABpAGUAbgB0AC4AVABpAG0AZQBvAHUAdAA9AFsAVABpAG0AZQBTAHAAYQBuAF0AOgA6AEYAcgBvAG0AUwBlAGMAbwBuAGQAcwAoADMAMAAwACkAOwAgACQAYwBsAGkAZQBuAHQALgBEAGUAZgBhAHUAbAB0AFIAZQBxAHUAZQBzAHQASABlAGEAZABlAHIAcwAuAFUAcwBlAHIAQQBnAGUAbgB0AC4AUABhAHIAcwBlAEEAZABkACgAJAB1AGEAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AQQBjAGMAZQBwAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAG8AYwB0AGUAdAAtAHMAdAByAGUAYQBtACcAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AQQBjAGMAZQBwAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAHoAaQBwACcAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AQQBjAGMAZQBwAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAnACoALwAqACcAKQA7ACAAJAByAGUAcwBwAD0AJABjAGwAaQBlAG4AdAAuAEcAZQB0AEEAcwB5AG4AYwAoACQAdQByAGwALABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASAB0AHQAcABDAG8AbQBwAGwAZQB0AGkAbwBuAE8AcAB0AGkAbwBuAF0AOgA6AFIAZQBzAHAAbwBuAHMAZQBIAGUAYQBkAGUAcgBzAFIAZQBhAGQAKQAuAEcAZQB0AEEAdwBhAGkAdABlAHIAKAApAC4ARwBlAHQAUgBlAHMAdQBsAHQAKAApADsAIAAkAHIAZQBzAHAALgBFAG4AcwB1AHIAZQBTAHUAYwBjAGUAcwBzAFMAdABhAHQAdQBzAEMAbwBkAGUAKAApACAAfAAgAE8AdQB0AC0ATgB1AGwAbAA7ACAAJABzAHQAcgBlAGEAbQA9ACQAcgBlAHMAcAAuAEMAbwBuAHQAZQBuAHQALgBSAGUAYQBkAEEAcwBTAHQAcgBlAGEAbQBBAHMAeQBuAGMAKAApAC4ARwBlAHQAQQB3AGEAaQB0AGUAcgAoACkALgBHAGUAdABSAGUAcwB1AGwAdAAoACkAOwAgACQAZgBpAGwAZQA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBPAHAAZQBuACgAJABvAHUAdAAsAFsASQBPAC4ARgBpAGwAZQBNAG8AZABlAF0AOgA6AEMAcgBlAGEAdABlACwAWwBJAE8ALgBGAGkAbABlAEEAYwBjAGUAcwBzAF0AOgA6AFcAcgBpAHQAZQAsAFsASQBPAC4ARgBpAGwAZQBTAGgAYQByAGUAXQA6ADoATgBvAG4AZQApADsAIAAkAGIAdQBmAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAGIAeQB0AGUAWwBdACAAMQAwADQAOAA1ADcANgA7ACAAdAByAHkAIAB7ACAAdwBoAGkAbABlACAAKAAoACQAcgBlAGEAZAA9ACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHUAZgAsADAALAAkAGIAdQBmAC4ATABlAG4AZwB0AGgAKQApACAALQBnAHQAIAAwACkAIAB7ACAAJABmAGkAbABlAC4AVwByAGkAdABlACgAJABiAHUAZgAsADAALAAkAHIAZQBhAGQAKQAgAH0AIAB9ACAAZgBpAG4AYQBsAGwAeQAgAHsAIAAkAGYAaQBsAGUALgBDAGwAbwBzAGUAKAApADsAIAAkAHMAdAByAGUAYQBtAC4AQwBsAG8AcwBlACgAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAaQBzAHAAbwBzAGUAKAApADsAIABpAGYAIAAoACQAcgBlAHMAcAApACAAewAgACQAcgBlAHMAcAAuAEQAaQBzAHAAbwBzAGUAKAApACAAfQAgAH0AIABlAHgAaQB0ACAAMAAgAH0AIABjAGEAdABjAGgAIAB7ACAAdAByAHkAIAB7ACAAJAB3AGMAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7ACAAJAB3AGMALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAnAFUAcwBlAHIALQBBAGcAZQBuAHQAJwAsACQAdQBhACkAOwAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBBAGMAYwBlAHAAdAAnACwAJwBhAHAAcABsAGkAYwBhAHQAaQBvAG4ALwBvAGMAdABlAHQALQBzAHQAcgBlAGEAbQAsAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAHoAaQBwACwAKgAvACoAJwApADsAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAQQBjAGMAZQBwAHQALQBMAGEAbgBnAHUAYQBnAGUAJwAsACcAcgB1AC0AUgBVACwAcgB1ADsAcQA9ADAALgA5ACwAZQBuAC0AVQBTADsAcQA9ADAALgA3ACwAZQBuADsAcQA9ADAALgA2ACcAKQA7ACAAJAB3AGMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAdQByAGwALAAkAG8AdQB0ACkAOwAgAGUAeABpAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAIABlAHgAaQB0ACAAMQAgAH0AIAB9AA==
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
  2⤵
  PID:1596
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
  2⤵
  PID:548
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3980
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:432
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3184
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1624
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1512
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3776
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4328
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1108
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2604
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4032
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4680
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1632
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4128
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2008
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3976
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1996
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4568
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:772
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1276
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2864
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fddbfc52e722de414b5fc5d75514ff7d57576f91f5eadffc1a093a19e08b352
MD5 c2049406b12e354cac87c68738a6fa4f
SHA1 cb095ccc55f3aa00d4f1a43c729ffa065f67cad3
SHA512 032ea9446a1eb5f64e22da92889d01c755a0b008a7c886eade6c1dfd8b815ed48fd011793fb59791892bee07504d6c42f2ac4f614ab0e23af0743dcaeaf1d039
TLSH
T12561ED323375B1D8C9167F071E68598063BF4355EAA4AF1CB29C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eddb29cf266f2da2ec5fde01676014d73e248e0e4c2db1006c491d97f1d89435
MD5 a42cf2a2ddb48d46e4d93013565d1fb6
SHA1 19d748b077abde06588e95f2eda615ce3b1bf1ab
SHA512 73f8bb4b91a2c86dc8e773b5f2c86af5d7c3448770ffb378c367b4f69752e813a489727518ae3d7dbd50ba50c6ebf7c5095feaa43d37853b4aaf3d36f444a76c
TLSH
T192218623F39CC920CC86013A009EEC1172B583C7809ECE9F6BC4D218A06F484CB616A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a45bfb68c08c397ed547cedfd10de38b9bcc7e1be945ca463189af7a05140b2f
MD5 993a796b0a843764e7e59a5da68dd709
SHA1 7d953adc8bcb5f17454a4b8fb357f9397ca8ab90
SHA512 3de8cf8d28c8f3d9d44493d64b44c60daec69610b4e00fe6cc0a9cbe2a4ae30db308107aa0c3f9a3aecab6faec59bdeb8e7c7372183c128b08bfc1070ba98350
TLSH
T1A231B837B3DC89E0C896023A009E9C2077B692D381DECFDB7BC4D604A57F688CB61180
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ff8bf029f56d119552d0f9ca8a54053214644e56dee8c9e7c73778b4b007599b
MD5 36bc7ee02f3ed0ab70f3dbdff48c695b
SHA1 89aa7292d24d14323c3c976e81d0255fd2273142
SHA512 61c005f532e1af2c5d4c0aebf257bf77407110661943d7d06d2e573a3ca034e861592dac3156ec3609e07f6220b4c61e40865451e29bbf93c39ef2cf334e1406
TLSH
T1BA21A827F39CC920CC86013A009E9C0172B583C7409ECE9F7BC0C214E07F484CB716A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 43542ad643c2b5e1d959e836143d44170c6cb34e5a1c8ae4e738f5c2e304d8b5
MD5 14a1f6fe572bd922645ed79ba5961f6a
SHA1 4e73171734b435a8e67348e048d8e65fccefdf8c
SHA512 50d1b4f03f9e01f742b3c727e5e41595c0035d4907b096b23c73af9ab59e3851ec69f3a85544c13ab4828615a2464f39c2c81251f33f92e326dddf9fa4f6eb16
TLSH
T1E831B827B3DC85E0C896063A009E9D2077B692D380DECFDBABC4D604A57F688CF21180
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_p15avcby.ehg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p15avcby.ehg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 239KB
SHA256 60e95026983e128a81f7c7ed11fe7e94373ce4604216fd879f7d340cf8844d3a
MD5 7763ef1c11bbb141c4476592a64c2535
SHA1 e492f979b20d2ea46f0bc891392b5394fde50364
SHA512 d2830347a4c83b0f16575767ff24f49f10ad88effccdac86b797526494066efdb5abff8b54b950a38f6392029ef72c13893aea8b8f6ac95c06971ccd630dfce2
SSDEEP 6144:5GATHnHkyQ0HMJZpO6AtEnJ1Py040UmugkM:UATHH4OKZ/AanJ1a0UmTD
TLSH
T1CA3423B8A524B480A7735CBBEE57206D5BDFBA8083733E402A1462D854DBDAFD6631C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserDownloadsView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
Size 361KB
SHA256 47cab171cc417e98b1189a38dfe22bba8610f19bd5b0fb35ede702c70a63e476
MD5 7a4ff12c024a734eeef91e1ef62400fb
SHA1 9ab3034027262dd4fbb07085060d843dec7c84dc
SHA512 b9c070489fef147a4a4206cc2dc11326157fd445c9166f09a9da857acff8e25a8a9303a0c86b466c14a08ec005ac39c1e57ba015c6d66cb67ad09760b8372c76
SSDEEP 6144:OBW66GOJQLy9K4/R6GuaRE5sfWCz/9oRcXCuot8RxLf+LyH:TOOGLz4/Bb0sf9zloRciS0yH
TLSH
T1B4749D12F2E28076E4F316701B3A1F36AEBABA104531CD0B57D81C895EB46A1E63F757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 52KB
SHA256 84057a0660a51f07c56d893b9949befcc55a271c0e65a23e765bf958b2ae947a
MD5 f8f7a4448239fb7e682cc30fe0971eb8
SHA1 be1bfbbcdbd0ac18d3da0e0c164bb0c90a959a1b
SHA512 354b17319ba82040f083f2e0a77eada47b95b0a48d4a7d8c751d7e77e834b3c3a3bdd8248dc5159735e98cc73c26116f95f03891c13c47f0e3e6ef235c9882d4
SSDEEP 1536:NavGicksQ9XONjlWCYo15HX5ot0xevNFgzP:cGic9Q9chGe5oDa
TLSH
T17E330230B3CF489C986BDDE5C463045AD2B326EC54613A9A268EC88B8C4FC49F941E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecutedProgramsList.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
Size 81KB
SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
MD5 7366668cc7eaa1068a38cc2761217fc4
SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
TLSH
T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recentfilesview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part
Size 48KB
SHA256 6920cc0165fcffa1a009c663c3dce7c84a62ca0e4b73d9d86dc9cc0dc39dca61
MD5 33560ffee697fe5e598fc49dab473191
SHA1 58a3a2ef1bb0acef03256299382e5b33ac416057
SHA512 e4dd816625ada957627b0769567c054d486b593bd9e8c22946b714103c918ff7f82fa1736857c30c680949591d4366bc49127bd042a23d427874625f6efa9815
SSDEEP 1536:i1+IlIEkBSyxmqQ3nZVKjDHyMWYVlM57RVzOX+a7:i1+ICEySinHyMWQerVE7
TLSH
T1C123027DD8113E2DFD5A42F7B3C224D541052BB4DE9B26E5B30BAD90C4502A7E28A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecentFilesView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
Size 46KB
SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
MD5 4d27a0ef39f71709510662519553b24d
SHA1 35adea46f3fde61c14230c67b687086429fc8438
SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
TLSH
T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-111-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/432-103-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1176-21-0x000001C06CD00000-0x000001C06CD12000-memory.dmp

Download

memory/1176-22-0x000001C06CCC0000-0x000001C06CCCA000-memory.dmp

Download

memory/1512-116-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1576-155-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1996-146-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3040-123-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3612-0-0x0000020A19D40000-0x0000020A19D62000-memory.dmp

Download

memory/4032-130-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4128-137-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4864-107-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4864-99-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4992-161-0x0000000000400000-0x0000000000417000-memory.dmp

Download