“After gaining access to a Windows system and achieving persistence, the malware would read from a “.chk” file that impersonated event logs.”

https://www.bleepingcomputer.com/news/security/attackers-abuse-google-dns-over-https-to-download-malware/