sheetrat | c6694c1a76fa191ff75af8a391961ef51c023cdb672173836bb579a6db36526e

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	brabus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	xdwdOBS Studio Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	xdwdOBS Studio Update.exe

Executes dropped EXE 6 IoCs

pid	Process
788	xdwdOBS Studio Update.exe
3924	xdwdCorelDRAW.exe
1120	bcdd4d0a-4546-4a8f-9679-123ad7599594.exe
3656	xdwdCorelDRAW.exe
3500	xdwdOBS Studio Update.exe
3112	xdwdCorelDRAW.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pidoras = "C:\\Users\\Public\\Pictures\\xdwdOBS Studio Update.exe"	brabus.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
36	raw.githubusercontent.com
37	raw.githubusercontent.com

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Looks up external IP address via web service 17 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
64	api.ipify.org
96	api.ipify.org
117	checkip.amazonaws.com
15	icanhazip.com
51	checkip.amazonaws.com
63	api.ipify.org
98	icanhazip.com
100	ipinfo.io
101	ipinfo.io
52	checkip.amazonaws.com
114	ipinfo.io
116	checkip.amazonaws.com
16	icanhazip.com
47	ipinfo.io
12	api.ipify.org
43	ipinfo.io
44	ipinfo.io

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2556	sc.exe
6076	sc.exe
3044	sc.exe
1228	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5552	CMD.exe
1124	CMD.exe
3880	CMD.exe
3188	CMD.exe
2344	CMD.exe
5188	CMD.exe
5012	CMD.exe
700	CMD.exe
5796	CMD.exe
1996	CMD.exe
4484	CMD.exe
5356	CMD.exe
5936	CMD.exe
892	CMD.exe
1816	CMD.exe
3080	CMD.exe
2712	CMD.exe
3084	CMD.exe
2072	CMD.exe
4508	CMD.exe
1420	CMD.exe
4496	CMD.exe
5948	CMD.exe
3896	CMD.exe
868	CMD.exe
5868	CMD.exe
908	CMD.exe
5316	CMD.exe
5808	CMD.exe
3980	CMD.exe
5428	CMD.exe
4548	CMD.exe
5584	CMD.exe
4580	CMD.exe
2488	CMD.exe
3820	CMD.exe
5324	CMD.exe
2400	CMD.exe
5072	CMD.exe
1668	CMD.exe
5608	CMD.exe
1456	CMD.exe
5992	CMD.exe
5540	CMD.exe
1496	CMD.exe
716	CMD.exe
652	CMD.exe
3232	CMD.exe
4344	CMD.exe
548	CMD.exe
4236	CMD.exe
5364	CMD.exe
5596	CMD.exe
5832	CMD.exe
5096	CMD.exe
6104	CMD.exe
2068	CMD.exe
4280	CMD.exe
3520	CMD.exe
1144	CMD.exe
2136	CMD.exe
6140	CMD.exe
2520	CMD.exe
4960	CMD.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5688	msedge.exe
6116	msedge.exe
1752	msedge.exe
1212	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdOBS Studio Update.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{CC4434E5-2B05-4B90-A875-603C1F4E16AE}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdOBS Studio Update.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4156	schtasks.exe
2096	schtasks.exe
3548	schtasks.exe
5116	schtasks.exe
3972	schtasks.exe
744	schtasks.exe
4860	schtasks.exe
3828	schtasks.exe
6128	schtasks.exe
6128	schtasks.exe
4056	schtasks.exe
5616	schtasks.exe
5712	schtasks.exe
5388	schtasks.exe
5568	schtasks.exe
4648	schtasks.exe
2168	schtasks.exe
6004	schtasks.exe
5888	schtasks.exe
5892	schtasks.exe
1824	schtasks.exe
3896	schtasks.exe
5480	schtasks.exe
5676	schtasks.exe
4156	schtasks.exe
5604	schtasks.exe
4428	schtasks.exe
1064	schtasks.exe
5628	schtasks.exe
3884	schtasks.exe
5340	schtasks.exe
1976	schtasks.exe
6132	schtasks.exe
3044	schtasks.exe
1108	schtasks.exe
5692	schtasks.exe
4424	schtasks.exe
5284	schtasks.exe
5976	schtasks.exe
5360	schtasks.exe
2096	schtasks.exe
4528	schtasks.exe
2516	schtasks.exe
5140	schtasks.exe
5224	schtasks.exe
5448	schtasks.exe
2404	schtasks.exe
5360	schtasks.exe
4876	schtasks.exe
5668	schtasks.exe
4736	schtasks.exe
5228	schtasks.exe
2152	schtasks.exe
1380	schtasks.exe
4508	schtasks.exe
5948	schtasks.exe
5960	schtasks.exe
4424	schtasks.exe
1776	schtasks.exe
388	schtasks.exe
2060	schtasks.exe
5632	schtasks.exe
3196	schtasks.exe
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
4240	brabus.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
788	xdwdOBS Studio Update.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4708	taskmgr.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2928	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	brabus.exe
Token: SeDebugPrivilege	788	xdwdOBS Studio Update.exe
Token: SeDebugPrivilege	3924	xdwdCorelDRAW.exe
Token: SeDebugPrivilege	3656	xdwdCorelDRAW.exe
Token: SeDebugPrivilege	4708	taskmgr.exe
Token: SeSystemProfilePrivilege	4708	taskmgr.exe
Token: SeCreateGlobalPrivilege	4708	taskmgr.exe
Token: SeDebugPrivilege	3500	xdwdOBS Studio Update.exe
Token: SeDebugPrivilege	3112	xdwdCorelDRAW.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe
4708	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1816	4240	brabus.exe	88
PID 1816 wrote to memory of 1968	1816	CMD.exe	90
PID 4240 wrote to memory of 4376	4240	brabus.exe	91
PID 4376 wrote to memory of 5056	4376	CMD.exe	93
PID 4240 wrote to memory of 3880	4240	brabus.exe	94
PID 3880 wrote to memory of 2152	3880	CMD.exe	96
PID 4240 wrote to memory of 3520	4240	brabus.exe	107
PID 3520 wrote to memory of 1800	3520	CMD.exe	109
PID 4240 wrote to memory of 1144	4240	brabus.exe	112
PID 1144 wrote to memory of 1380	1144	CMD.exe	114
PID 4240 wrote to memory of 3188	4240	brabus.exe	118
PID 3188 wrote to memory of 4428	3188	CMD.exe	120
PID 4240 wrote to memory of 548	4240	brabus.exe	121
PID 548 wrote to memory of 3240	548	CMD.exe	123
PID 4240 wrote to memory of 3236	4240	brabus.exe	124
PID 3236 wrote to memory of 388	3236	CMD.exe	126
PID 4240 wrote to memory of 3080	4240	brabus.exe	127
PID 3080 wrote to memory of 1064	3080	CMD.exe	129
PID 4240 wrote to memory of 2136	4240	brabus.exe	130
PID 2136 wrote to memory of 2404	2136	CMD.exe	132
PID 4240 wrote to memory of 908	4240	brabus.exe	133
PID 908 wrote to memory of 2168	908	CMD.exe	135
PID 4240 wrote to memory of 2344	4240	brabus.exe	136
PID 2344 wrote to memory of 5044	2344	CMD.exe	138
PID 4240 wrote to memory of 1996	4240	brabus.exe	139
PID 1996 wrote to memory of 4708	1996	CMD.exe	141
PID 4240 wrote to memory of 3812	4240	brabus.exe	142
PID 3812 wrote to memory of 3828	3812	CMD.exe	144
PID 3924 wrote to memory of 628	3924	xdwdCorelDRAW.exe	145
PID 628 wrote to memory of 1620	628	CMD.exe	147
PID 4240 wrote to memory of 2400	4240	brabus.exe	148
PID 2400 wrote to memory of 2060	2400	CMD.exe	150
PID 3924 wrote to memory of 1456	3924	xdwdCorelDRAW.exe	151
PID 1456 wrote to memory of 3044	1456	CMD.exe	153
PID 4240 wrote to memory of 4496	4240	brabus.exe	154
PID 4496 wrote to memory of 4888	4496	CMD.exe	156
PID 4240 wrote to memory of 3012	4240	brabus.exe	157
PID 3012 wrote to memory of 3548	3012	CMD.exe	159
PID 4240 wrote to memory of 1120	4240	brabus.exe	160
PID 4240 wrote to memory of 2712	4240	brabus.exe	165
PID 2712 wrote to memory of 4528	2712	CMD.exe	167
PID 4240 wrote to memory of 3084	4240	brabus.exe	169
PID 3084 wrote to memory of 4604	3084	CMD.exe	171
PID 4240 wrote to memory of 2072	4240	brabus.exe	175
PID 2072 wrote to memory of 2036	2072	CMD.exe	177
PID 788 wrote to memory of 2076	788	xdwdOBS Studio Update.exe	178
PID 2076 wrote to memory of 4508	2076	CMD.exe	180
PID 4240 wrote to memory of 552	4240	brabus.exe	181
PID 552 wrote to memory of 736	552	CMD.exe	183
PID 788 wrote to memory of 3656	788	xdwdOBS Studio Update.exe	184
PID 4240 wrote to memory of 4696	4240	brabus.exe	185
PID 4696 wrote to memory of 1744	4696	CMD.exe	187
PID 4240 wrote to memory of 5092	4240	brabus.exe	193
PID 5092 wrote to memory of 4896	5092	CMD.exe	195
PID 4240 wrote to memory of 892	4240	brabus.exe	196
PID 892 wrote to memory of 4860	892	CMD.exe	198
PID 4396 wrote to memory of 2928	4396	msedge.exe	205
PID 2928 wrote to memory of 4948	2928	msedge.exe	206
PID 2928 wrote to memory of 1212	2928	msedge.exe	207
PID 2928 wrote to memory of 4412	2928	msedge.exe	208
PID 2928 wrote to memory of 4412	2928	msedge.exe	208
PID 2928 wrote to memory of 4412	2928	msedge.exe	208
PID 2928 wrote to memory of 1076	2928	msedge.exe	209
PID 2928 wrote to memory of 1076	2928	msedge.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\brabus.exe
"C:\Users\Admin\AppData\Local\Temp\brabus.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Quicken" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Quicken" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"
    3⤵
    PID:1968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Flight Simulator" /tr "C:\Users\Public\Pictures\xdwdOBS Studio Update.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Flight Simulator" /tr "C:\Users\Public\Pictures\xdwdOBS Studio Update.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:1800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:3240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3828
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3548
- C:\Users\Admin\AppData\Local\Temp\bcdd4d0a-4546-4a8f-9679-123ad7599594.exe
  "C:\Users\Admin\AppData\Local\Temp\bcdd4d0a-4546-4a8f-9679-123ad7599594.exe"
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4528
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:1744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4896
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5628
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5268
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:3460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:6036
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:6004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:3432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:3044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4544
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3588
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5712
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5816
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:6060
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:6024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3972
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:1364
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:6072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2932
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop USBSTOR
  2⤵
  - Launches sc.exe
  PID:3044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3896
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start USBSTOR
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5340
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:2052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:1344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:1420
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" stop USBSTOR
  2⤵
  - Launches sc.exe
  PID:2556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4104
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" start USBSTOR
  2⤵
  - Launches sc.exe
  PID:6076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4736
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4924
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4296
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3896
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:6108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5508
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:2480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5728
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:2788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:6000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4736
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:4468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:4124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:6108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:5372
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3224
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5324
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:5532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:3400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:2028

C:\Users\Public\Pictures\xdwdOBS Studio Update.exe
"C:\Users\Public\Pictures\xdwdOBS Studio Update.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3656
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:5992
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      PID:6040
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    PID:5760
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5616

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    PID:1620
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3044

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4840d5b3h2e17h4770h936bh89d4da24997b
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault4840d5b3h2e17h4770h936bh89d4da24997b --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7fff8fbdc188,0x7fff8fbdc194,0x7fff8fbdc1a0
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,6615344025351278074,2361265535603737843,524288 --field-trial-handle=2220,i,4353448185589536270,9035649882438161885,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
    3⤵
    - System Time Discovery
    PID:1212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,8078730580255548623,2115566653585848702,262144 --field-trial-handle=2220,i,4353448185589536270,9035649882438161885,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,3804675308882674814,14520341498338230810,524288 --field-trial-handle=2220,i,4353448185589536270,9035649882438161885,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3124,i,3690103523988047501,7818630701137742149,2097152 --field-trial-handle=2220,i,4353448185589536270,9035649882438161885,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:2
    3⤵
    PID:1364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte18a53b8h3381h479ehb811h156aeeabf5da
1⤵
- Enumerates system info in registry
PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7fff8fbdc188,0x7fff8fbdc194,0x7fff8fbdc1a0
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,10483457048937603033,12429983620569257200,524288 --field-trial-handle=2288,i,15585894377100404093,1556402411690314513,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,6096748583920639130,12794548708634953421,262144 --field-trial-handle=2288,i,15585894377100404093,1556402411690314513,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,3228356232324643118,17711482937759643567,524288 --field-trial-handle=2288,i,15585894377100404093,1556402411690314513,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:8
  2⤵
  PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultef09c7eahdad2h4436ha8cdh7341a6bc664c
1⤵
- Enumerates system info in registry
PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x2cc,0x7fff8fbdc188,0x7fff8fbdc194,0x7fff8fbdc1a0
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,3564651199640868821,1272360583828268205,524288 --field-trial-handle=2364,i,4671712747152121945,10647553501161574819,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:6116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,16556527293436580673,5794212210914048336,262144 --field-trial-handle=2364,i,4671712747152121945,10647553501161574819,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,7669897657179031763,10653757997074789602,524288 --field-trial-handle=2364,i,4671712747152121945,10647553501161574819,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault536c0591hccd1h494cha6a0h9690b21e2492
1⤵
- Enumerates system info in registry
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7fff8fbdc188,0x7fff8fbdc194,0x7fff8fbdc1a0
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15790727984297995542,8793245834714198391,524288 --field-trial-handle=2368,i,12005801723306025114,13133527114300095045,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,9249197995973589332,8832747497308144243,262144 --field-trial-handle=2368,i,12005801723306025114,13133527114300095045,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,13406608426954402277,6002350965981767940,524288 --field-trial-handle=2368,i,12005801723306025114,13133527114300095045,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4348

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4708

C:\Users\Public\Pictures\xdwdOBS Studio Update.exe
"C:\Users\Public\Pictures\xdwdOBS Studio Update.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3500
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
  2⤵
  PID:232
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3196
- C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3112
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    PID:5676
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4424
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST & exit
    3⤵
    PID:1640
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "Inkscape" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdCorelDRAW.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery