sheetrat | hxxps://drive[.]google[.]com/file/d/1A8uuJAHjekYXpjUXiCN71EN0Bk3yOP75/view

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	dnSpy.exe

Executes dropped EXE 3 IoCs

pid	Process
5804	dnSpy.exe
408	Optimize.exe
1868	xdwdGreenshot.exe

Loads dropped DLL 64 IoCs

pid	Process
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe
5804	dnSpy.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	drive.google.com
8	drive.google.com
14	drive.google.com
23	drive.google.com
51	drive.google.com
113	drive.google.com

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Optimize.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207482677898596"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2714754311-527593155-1440850301-1000\{369E07C9-426F-4E7E-95D2-6C1104D2659D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3460	schtasks.exe
4640	schtasks.exe
4560	schtasks.exe
2464	schtasks.exe
5396	schtasks.exe
4836	schtasks.exe
1428	schtasks.exe
3268	schtasks.exe
3348	schtasks.exe
3000	schtasks.exe
1128	schtasks.exe
3284	schtasks.exe
3988	schtasks.exe
3988	schtasks.exe
5464	schtasks.exe
5240	schtasks.exe
6028	schtasks.exe
6076	schtasks.exe
3796	schtasks.exe
5896	schtasks.exe
3720	schtasks.exe
5872	schtasks.exe
2932	schtasks.exe
5828	schtasks.exe
3128	schtasks.exe
2832	schtasks.exe
1072	schtasks.exe
4592	schtasks.exe
1312	schtasks.exe
1168	schtasks.exe
4192	schtasks.exe
468	schtasks.exe
5380	schtasks.exe
5500	schtasks.exe
5304	schtasks.exe
5860	schtasks.exe
5440	schtasks.exe
2300	schtasks.exe
5020	schtasks.exe
4424	schtasks.exe
3320	schtasks.exe
5744	schtasks.exe
4616	schtasks.exe
4796	schtasks.exe
5952	schtasks.exe
700	schtasks.exe
2188	schtasks.exe
1180	schtasks.exe
6060	schtasks.exe
5220	schtasks.exe
5192	schtasks.exe
3572	schtasks.exe
1816	schtasks.exe
4408	schtasks.exe
5748	schtasks.exe
5064	schtasks.exe
5992	schtasks.exe
4804	schtasks.exe
4408	schtasks.exe
4208	schtasks.exe
2932	schtasks.exe
5240	schtasks.exe
5904	schtasks.exe
3324	schtasks.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	3656	7zG.exe
Token: 35	3656	7zG.exe
Token: SeSecurityPrivilege	3656	7zG.exe
Token: SeSecurityPrivilege	3656	7zG.exe
Token: SeRestorePrivilege	5604	7zG.exe
Token: 35	5604	7zG.exe
Token: SeSecurityPrivilege	5604	7zG.exe
Token: SeSecurityPrivilege	5604	7zG.exe
Token: SeDebugPrivilege	408	Optimize.exe
Token: SeDebugPrivilege	1868	xdwdGreenshot.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
3656	7zG.exe
5604	7zG.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe
2512	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4128	2512	msedge.exe	83
PID 2512 wrote to memory of 1856	2512	msedge.exe	84
PID 2512 wrote to memory of 1128	2512	msedge.exe	85
PID 2512 wrote to memory of 1128	2512	msedge.exe	85
PID 2512 wrote to memory of 1128	2512	msedge.exe	85
PID 2512 wrote to memory of 4936	2512	msedge.exe	86
PID 2512 wrote to memory of 4936	2512	msedge.exe	86
PID 2512 wrote to memory of 2192	2512	msedge.exe	88
PID 2512 wrote to memory of 2192	2512	msedge.exe	88
PID 2512 wrote to memory of 2192	2512	msedge.exe	88
PID 2512 wrote to memory of 3712	2512	msedge.exe	89
PID 2512 wrote to memory of 3712	2512	msedge.exe	89
PID 2512 wrote to memory of 3712	2512	msedge.exe	89
PID 2512 wrote to memory of 1872	2512	msedge.exe	90
PID 2512 wrote to memory of 1872	2512	msedge.exe	90
PID 2512 wrote to memory of 1872	2512	msedge.exe	90
PID 2512 wrote to memory of 3524	2512	msedge.exe	91
PID 2512 wrote to memory of 3524	2512	msedge.exe	91
PID 2512 wrote to memory of 3524	2512	msedge.exe	91
PID 2512 wrote to memory of 4652	2512	msedge.exe	94
PID 2512 wrote to memory of 4652	2512	msedge.exe	94
PID 2512 wrote to memory of 4528	2512	msedge.exe	95
PID 2512 wrote to memory of 4528	2512	msedge.exe	95
PID 2512 wrote to memory of 2328	2512	msedge.exe	98
PID 2512 wrote to memory of 2328	2512	msedge.exe	98
PID 2512 wrote to memory of 2300	2512	msedge.exe	97
PID 2512 wrote to memory of 2300	2512	msedge.exe	97
PID 2512 wrote to memory of 2672	2512	msedge.exe	100
PID 2512 wrote to memory of 4892	2512	msedge.exe	101
PID 2512 wrote to memory of 4892	2512	msedge.exe	101
PID 2512 wrote to memory of 1432	2512	msedge.exe	102
PID 2512 wrote to memory of 1432	2512	msedge.exe	102
PID 2512 wrote to memory of 4524	2512	msedge.exe	103
PID 2512 wrote to memory of 4524	2512	msedge.exe	103
PID 2512 wrote to memory of 3948	2512	msedge.exe	104
PID 2512 wrote to memory of 3948	2512	msedge.exe	104
PID 2512 wrote to memory of 5100	2512	msedge.exe	105
PID 2512 wrote to memory of 5100	2512	msedge.exe	105
PID 2512 wrote to memory of 328	2512	msedge.exe	106
PID 2512 wrote to memory of 328	2512	msedge.exe	106
PID 2512 wrote to memory of 328	2512	msedge.exe	106
PID 2512 wrote to memory of 2540	2512	msedge.exe	107
PID 2512 wrote to memory of 2540	2512	msedge.exe	107
PID 2512 wrote to memory of 2540	2512	msedge.exe	107
PID 2512 wrote to memory of 796	2512	msedge.exe	108
PID 2512 wrote to memory of 3504	2512	msedge.exe	109
PID 2512 wrote to memory of 796	2512	msedge.exe	108
PID 2512 wrote to memory of 3504	2512	msedge.exe	109
PID 2512 wrote to memory of 3504	2512	msedge.exe	109
PID 2512 wrote to memory of 3844	2512	msedge.exe	110
PID 2512 wrote to memory of 1916	2512	msedge.exe	113
PID 2512 wrote to memory of 1916	2512	msedge.exe	113
PID 2512 wrote to memory of 1916	2512	msedge.exe	113
PID 2512 wrote to memory of 1640	2512	msedge.exe	114
PID 2512 wrote to memory of 1640	2512	msedge.exe	114
PID 2512 wrote to memory of 4508	2512	msedge.exe	115
PID 2512 wrote to memory of 4508	2512	msedge.exe	115
PID 2512 wrote to memory of 4508	2512	msedge.exe	115
PID 2512 wrote to memory of 3272	2512	msedge.exe	116
PID 2512 wrote to memory of 3272	2512	msedge.exe	116
PID 2512 wrote to memory of 3272	2512	msedge.exe	116
PID 2512 wrote to memory of 5004	2512	msedge.exe	117
PID 2512 wrote to memory of 5004	2512	msedge.exe	117
PID 2512 wrote to memory of 5004	2512	msedge.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1A8uuJAHjekYXpjUXiCN71EN0Bk3yOP75/view
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9c675c188,0x7ff9c675c194,0x7ff9c675c1a0
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,16033126577215937195,11130982960137261028,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,5580268325805026154,16234663060325613789,262144 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,14434462877966898384,9806810027738032592,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,1585793067028640327,4962187428439369855,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,14309438000335239045,3299514375118944181,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,2337482615778979207,2419220565590501984,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,1458292245935527052,7623318524097156588,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,12107268244535887211,2400838920624464284,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,15431562387635368398,14422525250881203271,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,7616604064265006507,1576300066671329222,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,1793144444962314902,1877485543714503839,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17592347801905928849,7863838624803856024,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17592347801905928849,7863838624803856024,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1961905857609979542,8365134810696382092,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13424314822098842789,11442736656507146664,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16762995482873970777,16923072130638904540,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,5656147666777773839,2162806795397808637,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,6810503145199094313,17264117956731967838,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5432,i,11012976128326083082,12557296544068426298,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6424,i,3214010870562748670,15546818743381120455,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,17688256051270242631,10213296183539081158,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5416,i,6772678952520837499,10562467203039146164,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,7477314490349013394,3387765653049054878,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7000,i,6513670452364844888,3544222144259505140,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,12935641547343396252,16171546643455635131,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7476,i,11774379562478785686,97947464290334072,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4820,i,1576704861691365354,10759819849937482899,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7516,i,13471201440740675674,3733432775649591673,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,13316166704084402099,13639268335636025384,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,7840854954830535850,8675717166664539792,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,762182593663184925,12493087170111950545,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7720,i,8437870316823530530,51642575957929753,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8072,i,3849017860135788134,7827068689660386987,524288 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=8084 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8124,i,524632908158609540,14752469372091985115,2097152 --field-trial-handle=2300,i,2630900895019298939,190396479152915144,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5428

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\dnSpy-net-win64\" -spe -an -ai#7zMap10145:92:7zEvent27158
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3656

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Архив ZIP - WinRAR (2)\" -spe -an -ai#7zMap1202:106:7zEvent939
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5604

C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe
"C:\Users\Admin\Downloads\dnSpy-net-win64\dnSpy.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5804

C:\Users\Admin\Downloads\Архив ZIP - WinRAR (2)\Optimize.exe
"C:\Users\Admin\Downloads\Архив ZIP - WinRAR (2)\Optimize.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Spybot - Search & Destroy" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" & exit
  2⤵
  PID:4552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Spybot - Search & Destroy" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft PowerPoint" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe" /RL HIGHEST & exit
  2⤵
  PID:3184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft PowerPoint" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Dynamics CRM.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:700
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4612
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2572
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4848
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5568
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3136
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5920
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5344
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1408
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5788
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1092
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4288
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3844
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2816

C:\Users\Admin\Music\xdwdGreenshot.exe
C:\Users\Admin\Music\xdwdGreenshot.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1868
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5380
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5720
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5948
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5980
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1052
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5192
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4560
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5684
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4280
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5412
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4076
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5304
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3076
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1676
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:6012
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3968
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3900
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3456
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4208
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5328
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3284
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1816
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3320
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5772
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:176
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1692
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3796
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5932
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2508
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3988
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3060
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3496
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5240
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1972
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3284
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:760
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4636
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1312
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5748
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5952
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:6008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5044
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:6060
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3796
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4804
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5988
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4436
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3968
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:3468
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:1528
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5272
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2300
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5416
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1168
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2152
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4348
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:2400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:5204
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:2996
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:4268
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4192
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1428
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3988
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:5484
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:1908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:992
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:3556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:928
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST & exit
  2⤵
  PID:796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Wireshark" /tr "C:\Users\Admin\Music\xdwdGreenshot.exe" /RL HIGHEST
    3⤵
    PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery