sheetrat | 4e188fca4347c7c7b3e69de0007a82d7f84341a93ecf1e573c5c26177ea431c9

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\Control Panel\International\Geo\Nation	Client.exe

Executes dropped EXE 5 IoCs

pid	Process
4424	xdwdInkscape Upgrade.exe
5008	xdwdSnagit.exe
4828	rr2ttso5.04a.exe
3364	e2e8e54c-4298-425c-90a0-02b8ed38c830.exe
2148	c860bbeb-f99f-443a-ad78-9cf669ab9c02.exe

Loads dropped DLL 64 IoCs

pid	Process
2632	Process not Found
4992	Process not Found
2660	Process not Found
3788	Process not Found
5812	Process not Found
4424	xdwdInkscape Upgrade.exe
5008	xdwdSnagit.exe
4500	Process not Found
2192	WmiApSrv.exe
3556	Process not Found
3912	Process not Found
5940	Process not Found
4828	rr2ttso5.04a.exe
5460	Process not Found
5408	Process not Found
1224	Process not Found
2536	Process not Found
6100	Process not Found
824	Process not Found
5184	Process not Found
2608	Process not Found
1908	Process not Found
3064	Process not Found
2948	Process not Found
4496	Process not Found
3320	chrome.exe
4456	chrome.exe
5304	chrome.exe
5288	elevation_service.exe
696	Process not Found
2032	chrome.exe
3604	svchost.exe
732	Process not Found
5908	Process not Found
2936	Process not Found
1876	Process not Found
4844	Process not Found
3428	Process not Found
3776	Process not Found
4340	Process not Found
4956	AUDIODG.EXE
6140	chrome.exe
1752	chrome.exe
2896	chrome.exe
5300	Process not Found
1956	Process not Found
3484	Process not Found
4684	Process not Found
5508	Process not Found
5784	taskmgr.exe
5232	Process not Found
5880	Process not Found
3640	Process not Found
2892	Process not Found
3852	Process not Found
2476	Process not Found
4784	Process not Found
1828	Process not Found
5028	Process not Found
6120	Process not Found
6048	Process not Found
2224	Process not Found
1988	Process not Found
1968	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3579476765-2645189491-1706875375-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Your = "C:\\Windows\\xdwdInkscape Upgrade.exe"	Client.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
21	api.ipify.org
22	api.ipify.org
9	api.ipify.org

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\xdwdInkscape Upgrade.exe	Client.exe
File opened for modification	C:\Windows\xdwdInkscape Upgrade.exe	Client.exe
File created	C:\Windows\xdwd.dll	Client.exe
File opened for modification	C:\Windows\xdwdInkscape Upgrade.exe	xdwdInkscape Upgrade.exe
File opened for modification	C:\Windows\xdwdInkscape Upgrade.exe	xdwdSnagit.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e2e8e54c-4298-425c-90a0-02b8ed38c830.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5304	chrome.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134186613606687294"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4356	schtasks.exe
4756	schtasks.exe
6000	schtasks.exe
5436	schtasks.exe
4724	schtasks.exe
4020	schtasks.exe
5828	schtasks.exe
732	schtasks.exe
2820	schtasks.exe
5880	schtasks.exe
1120	schtasks.exe
4684	schtasks.exe
5256	schtasks.exe
2728	schtasks.exe
2860	schtasks.exe
2976	schtasks.exe
1000	schtasks.exe
5936	schtasks.exe
4244	schtasks.exe
1800	schtasks.exe
6116	schtasks.exe
1756	schtasks.exe
2692	schtasks.exe
8	schtasks.exe
5316	schtasks.exe
1248	schtasks.exe
4208	schtasks.exe
5288	schtasks.exe
3692	schtasks.exe
3168	schtasks.exe
5272	schtasks.exe
1500	schtasks.exe
2104	schtasks.exe
3508	schtasks.exe
2156	schtasks.exe
2120	schtasks.exe
1704	schtasks.exe
636	schtasks.exe
3764	schtasks.exe
4340	schtasks.exe
1892	schtasks.exe
1100	schtasks.exe
1684	schtasks.exe
3628	schtasks.exe
5892	schtasks.exe
5184	schtasks.exe
5704	schtasks.exe
1636	schtasks.exe
4300	schtasks.exe
5488	schtasks.exe
3052	schtasks.exe
5616	schtasks.exe
5376	schtasks.exe
4068	schtasks.exe
3620	schtasks.exe
2040	schtasks.exe
5176	schtasks.exe
3156	schtasks.exe
5944	schtasks.exe
5200	schtasks.exe
5584	schtasks.exe
1156	schtasks.exe
4648	schtasks.exe
5984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
3772	Client.exe
2192	WmiApSrv.exe
2192	WmiApSrv.exe
4828	rr2ttso5.04a.exe
4828	rr2ttso5.04a.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
4424	xdwdInkscape Upgrade.exe
3320	chrome.exe
3320	chrome.exe
5304	chrome.exe
5304	chrome.exe
3320	chrome.exe
3320	chrome.exe
5288	elevation_service.exe
5288	elevation_service.exe
2032	chrome.exe
2032	chrome.exe
3604	svchost.exe
3604	svchost.exe
4956	AUDIODG.EXE
4956	AUDIODG.EXE
6140	chrome.exe
6140	chrome.exe
1752	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5784	taskmgr.exe
3772	Client.exe

Suspicious behavior: LoadsDriver 18 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3772	Client.exe
Token: SeDebugPrivilege	5008	xdwdSnagit.exe
Token: SeDebugPrivilege	4424	xdwdInkscape Upgrade.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe
Token: SeCreatePagefilePrivilege	3320	chrome.exe
Token: SeShutdownPrivilege	3320	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
3320	chrome.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe
5784	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1592	3772	Client.exe	89
PID 1592 wrote to memory of 2872	1592	CMD.exe	91
PID 3772 wrote to memory of 5996	3772	Client.exe	92
PID 5996 wrote to memory of 5612	5996	CMD.exe	94
PID 3772 wrote to memory of 5844	3772	Client.exe	95
PID 5844 wrote to memory of 732	5844	CMD.exe	97
PID 3772 wrote to memory of 3020	3772	Client.exe	104
PID 3020 wrote to memory of 464	3020	CMD.exe	106
PID 3772 wrote to memory of 3828	3772	Client.exe	109
PID 3828 wrote to memory of 3492	3828	CMD.exe	111
PID 3772 wrote to memory of 4828	3772	Client.exe	113
PID 3772 wrote to memory of 224	3772	Client.exe	117
PID 224 wrote to memory of 2072	224	CMD.exe	119
PID 3772 wrote to memory of 2024	3772	Client.exe	120
PID 2024 wrote to memory of 2972	2024	CMD.exe	122
PID 3772 wrote to memory of 2944	3772	Client.exe	124
PID 2944 wrote to memory of 700	2944	CMD.exe	126
PID 4424 wrote to memory of 5336	4424	xdwdInkscape Upgrade.exe	127
PID 5336 wrote to memory of 1500	5336	CMD.exe	129
PID 5008 wrote to memory of 976	5008	xdwdSnagit.exe	130
PID 976 wrote to memory of 2728	976	CMD.exe	132
PID 3772 wrote to memory of 972	3772	Client.exe	133
PID 972 wrote to memory of 4620	972	CMD.exe	135
PID 5008 wrote to memory of 5356	5008	xdwdSnagit.exe	136
PID 5356 wrote to memory of 1248	5356	CMD.exe	138
PID 3772 wrote to memory of 4328	3772	Client.exe	139
PID 4328 wrote to memory of 5892	4328	CMD.exe	141
PID 3320 wrote to memory of 4456	3320	chrome.exe	145
PID 3320 wrote to memory of 4948	3320	chrome.exe	147
PID 3320 wrote to memory of 5304	3320	chrome.exe	146
PID 3320 wrote to memory of 4948	3320	chrome.exe	147
PID 3320 wrote to memory of 1668	3320	chrome.exe	148
PID 3320 wrote to memory of 1668	3320	chrome.exe	148
PID 3320 wrote to memory of 5624	3320	chrome.exe	150
PID 3320 wrote to memory of 5584	3320	chrome.exe	149
PID 3320 wrote to memory of 5624	3320	chrome.exe	150
PID 3320 wrote to memory of 5584	3320	chrome.exe	149
PID 3320 wrote to memory of 5840	3320	chrome.exe	152
PID 3320 wrote to memory of 5840	3320	chrome.exe	152
PID 3320 wrote to memory of 2044	3320	chrome.exe	153
PID 3320 wrote to memory of 2044	3320	chrome.exe	153
PID 3772 wrote to memory of 5312	3772	Client.exe	154
PID 5312 wrote to memory of 2528	5312	CMD.exe	156
PID 3320 wrote to memory of 2032	3320	chrome.exe	157
PID 3772 wrote to memory of 1172	3772	Client.exe	159
PID 1172 wrote to memory of 4208	1172	CMD.exe	161
PID 3772 wrote to memory of 4576	3772	Client.exe	162
PID 4576 wrote to memory of 5364	4576	CMD.exe	164
PID 3772 wrote to memory of 3996	3772	Client.exe	165
PID 3996 wrote to memory of 5004	3996	CMD.exe	167
PID 3772 wrote to memory of 2732	3772	Client.exe	168
PID 2732 wrote to memory of 5184	2732	CMD.exe	170
PID 3772 wrote to memory of 1524	3772	Client.exe	171
PID 1524 wrote to memory of 5704	1524	CMD.exe	173
PID 3772 wrote to memory of 5532	3772	Client.exe	174
PID 5532 wrote to memory of 1636	5532	CMD.exe	176
PID 3772 wrote to memory of 1248	3772	Client.exe	177
PID 1248 wrote to memory of 5160	1248	CMD.exe	179
PID 3772 wrote to memory of 3364	3772	Client.exe	180
PID 3772 wrote to memory of 4112	3772	Client.exe	181
PID 4112 wrote to memory of 5640	4112	CMD.exe	183
PID 3320 wrote to memory of 6140	3320	chrome.exe	185
PID 3320 wrote to memory of 1752	3320	chrome.exe	186
PID 3320 wrote to memory of 2896	3320	chrome.exe	187

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Downloads MZ/PE file
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Money" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Money" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe"
    3⤵
    PID:2872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "TeamViewer" /tr "C:\Windows\xdwdInkscape Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "TeamViewer" /tr "C:\Windows\xdwdInkscape Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3492
- C:\Users\Admin\AppData\Local\Temp\rr2ttso5.04a.exe
  "C:\Users\Admin\AppData\Local\Temp\rr2ttso5.04a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5160
- C:\Users\Admin\AppData\Local\Temp\e2e8e54c-4298-425c-90a0-02b8ed38c830.exe
  "C:\Users\Admin\AppData\Local\Temp\e2e8e54c-4298-425c-90a0-02b8ed38c830.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4300
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:6096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2820
- C:\Users\Admin\AppData\Local\Temp\c860bbeb-f99f-443a-ad78-9cf669ab9c02.exe
  "C:\Users\Admin\AppData\Local\Temp\c860bbeb-f99f-443a-ad78-9cf669ab9c02.exe"
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5656
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4596
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5676
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:956
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:6088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5436
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2984
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4336
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4856
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5288
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4168
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:6044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:6088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5520
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:6004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5200
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1692
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:5932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:2824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:3620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:5916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1708
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:3564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:4108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:1388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  PID:1400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:4072

C:\Windows\xdwdInkscape Upgrade.exe
"C:\Windows\xdwdInkscape Upgrade.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1500

C:\Users\Public\Pictures\xdwdSnagit.exe
C:\Users\Public\Pictures\xdwdSnagit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    PID:2728
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Discord" /tr "C:\Users\Public\Pictures\xdwdSnagit.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1248

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1c8,0x22c,0x7ff869a0c728,0x7ff869a0c734,0x7ff869a0c740
  2⤵
  - Loads dropped DLL
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1624,i,13089974924087462218,2110783571886502921,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Loads dropped DLL
  - System Time Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,13262760783274837733,11233528927747406721,262144 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,14908478776757467681,4536309061836320421,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,1346855251485436117,11090069382404523893,2097152 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,11515721381563127288,9747550132099163779,2097152 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4328,i,14195946050718076038,9468074494882848291,2097152 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4788,i,8146841267968376815,209940762004530480,2097152 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5432,i,1495286950197004284,5261194181396255263,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,1767183724992043993,17041352905409877663,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,8621893885110904966,13263373446741328746,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14756636447064322904,13376013748307409487,524288 --field-trial-handle=1880,i,4935794826216373401,6435109231260037069,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Loads dropped DLL
  PID:2896

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x2fc
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4956

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery