Boot or Logon Autostart Execution: Print Processors

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Credentials from Password Stores: Windows Credential Manager

Suspicious access to Credentials History.

Drops startup file

Executes dropped EXE

Indicator Removal: Clear Windows Event Logs

Clear Windows Event Logs to hide the activity of an intrusion.

Loads dropped DLL

Reads user/profile data of web browsers

Infostealers often target stored browser data, which can include saved credentials etc.

Drops file in System32 directory