zgrat | be9880ef9ccc6b51f6e22e21884bf7092da435c96a072bd9e9515eb88b7c6bd5

General

Target

ec3e0e37a0706e727186ef4a1d338b48.exe
Size

474KB
MD5

ec3e0e37a0706e727186ef4a1d338b48
SHA1

549d90919104da57c9ed2e6cbc3d4a654b32162b
SHA256

be9880ef9ccc6b51f6e22e21884bf7092da435c96a072bd9e9515eb88b7c6bd5
SHA512

6010946af214b0015b899f1fb1086a66a0e5d0851a35256f3294ea92e3557912cd129569220c69a4f593db37ad9027c3c7c297f904965ea9cc2e8af61a7a0862
SSDEEP

6144:hxxxVzbfkDOMpkMQ2S/YUa/fdchxRhu9X:hxxYtB8//acRuX

Score

10^/10

zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 28 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1096-23-0x0000000004400000-0x00000000044DC000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-29-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-27-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-73-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-67-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-65-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-63-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-61-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-57-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-47-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-45-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-25-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-41-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-75-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-71-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-69-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-59-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-55-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-53-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-51-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-49-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-43-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-37-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-39-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-35-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-33-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-31-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1
behavioral1/memory/1096-24-0x0000000004400000-0x00000000044D6000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Downloads MZ/PE file
Suspicious use of SetThreadContext 1 IoCs

Processes:

ec3e0e37a0706e727186ef4a1d338b48.exe

description pid process target process

PID 2744 set thread context of 1096 2744 ec3e0e37a0706e727186ef4a1d338b48.exe RegAsm.exe
Executes dropped EXE 1 IoCs

Processes:

WindowsLibrary.exe

pid process

3032 WindowsLibrary.exe
Loads dropped DLL 1 IoCs

Processes:

taskeng.exe

pid process

2532 taskeng.exe

description	pid	process	target process
PID 2744 set thread context of 1096	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	RegAsm.exe

pid	process
3032	WindowsLibrary.exe

pid	process
2532	taskeng.exe

Creates scheduled task(s) 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

SCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXeSCHtAsKs.EXe

pid	process
2608	SCHtAsKs.EXe
1040	SCHtAsKs.EXe
1988
1032	SCHtAsKs.EXe
2156	SCHtAsKs.EXe
6472
3528
2988	SCHtAsKs.EXe
1808	SCHtAsKs.EXe
3016	SCHtAsKs.EXe
1392	SCHtAsKs.EXe
2764	SCHtAsKs.EXe
2976	SCHtAsKs.EXe
5128
1640	SCHtAsKs.EXe
2828	SCHtAsKs.EXe
2836	SCHtAsKs.EXe
2332	SCHtAsKs.EXe
1800	SCHtAsKs.EXe
1540	SCHtAsKs.EXe
2944	SCHtAsKs.EXe
684	SCHtAsKs.EXe
2588	SCHtAsKs.EXe
5560
2388
1588	SCHtAsKs.EXe
1920
816	SCHtAsKs.EXe
768	SCHtAsKs.EXe
1992	SCHtAsKs.EXe
580	SCHtAsKs.EXe
3008
4148
6380
1184	SCHtAsKs.EXe
1816	SCHtAsKs.EXe
2000	SCHtAsKs.EXe
2164	SCHtAsKs.EXe
2184	SCHtAsKs.EXe
3852	SCHtAsKs.EXe
6124
680	SCHtAsKs.EXe
3012	SCHtAsKs.EXe
1716	SCHtAsKs.EXe
1352	SCHtAsKs.EXe
2580
6016
3552
1472	SCHtAsKs.EXe
1084	SCHtAsKs.EXe
2484	SCHtAsKs.EXe
1936	SCHtAsKs.EXe
2260	SCHtAsKs.EXe
580	SCHtAsKs.EXe
3604
4604
2876	SCHtAsKs.EXe
6876
2604	SCHtAsKs.EXe
5780
1628	SCHtAsKs.EXe
1248	SCHtAsKs.EXe
1524	SCHtAsKs.EXe
3228

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

ec3e0e37a0706e727186ef4a1d338b48.exeWindowsLibrary.exe

pid process

2744 ec3e0e37a0706e727186ef4a1d338b48.exe
2744 ec3e0e37a0706e727186ef4a1d338b48.exe
3032 WindowsLibrary.exe
3032 WindowsLibrary.exe

pid	process
2744	ec3e0e37a0706e727186ef4a1d338b48.exe
2744	ec3e0e37a0706e727186ef4a1d338b48.exe
3032	WindowsLibrary.exe
3032	WindowsLibrary.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

ec3e0e37a0706e727186ef4a1d338b48.exeWindowsLibrary.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	2744	ec3e0e37a0706e727186ef4a1d338b48.exe
Token: SeDebugPrivilege	3032	WindowsLibrary.exe
Token: SeDebugPrivilege	1096	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ec3e0e37a0706e727186ef4a1d338b48.exe

description	pid	process	target process
PID 2744 wrote to memory of 2700	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2700	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2700	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2264	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2264	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2264	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2552	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2552	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2552	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2640	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2640	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2640	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2768	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2768	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2768	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2756	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2756	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2756	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2616	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2616	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2616	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2752	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2752	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2752	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 1964	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 1964	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 1964	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2704	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2704	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2704	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2572	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2572	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2572	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2412	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2412	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2412	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2452	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2452	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2452	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2368	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2368	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2368	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2664	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2664	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2664	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2840	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2840	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2840	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 764	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 764	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 764	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2364	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2364	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 2364	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 984	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 984	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 984	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 892	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 892	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 892	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 580	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 580	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 580	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe
PID 2744 wrote to memory of 464	2744	ec3e0e37a0706e727186ef4a1d338b48.exe	SCHtAsKs.EXe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ec3e0e37a0706e727186ef4a1d338b48.exe
"C:\Users\Admin\AppData\Local\Temp\ec3e0e37a0706e727186ef4a1d338b48.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2552

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2640

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2704

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2572

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2412

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2452

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2368

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2840

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2364

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:892

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:464

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2164

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1648

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2396

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2496

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1788

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1996

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2224

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2028

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2328

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2448

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3048

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1820

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2776

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2988

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2052

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2108

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1848

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:968

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1640

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2272

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1508

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2252

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1688

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3064

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2284

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2500

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2512

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2636

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2692

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2432

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2424

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2836

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:532

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:796

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1548

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1644

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2604

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2008

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1956

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1032

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2220

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2344

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2216

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2068

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2176

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2732

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2772

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2132

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1804

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1312

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:820

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2972

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2180

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1760

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3028

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1544

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2844

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2908

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2684

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2532

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2416

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2208

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2456

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2440

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:480

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:760

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:680

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:744

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2544

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2708

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2384

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1868

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1972

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1708

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1920

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2312

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2780

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2072

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2340

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1628

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:868

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2904

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2124

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2116

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2168

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2244

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1932

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2612

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2436

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2464

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3024

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2392

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1720

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1728

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:916

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2508

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1808

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2232

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2200

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2740

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3032

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2148

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1336

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2748

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1704

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2160

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2308

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2088

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2032

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2888

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2444

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2480

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:940

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1940

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1796

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1952

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2296

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3044

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:440

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1776

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1748

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2024

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:896

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1288

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2260

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1148

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2556

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2636

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1336

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2508

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2436

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2452

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1868

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:532

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2308

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2072

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:820

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2424

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2640

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2988

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2552

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1688

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3048

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2652

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2520

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:816

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:684

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2928

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2060

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2268

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:376

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:324

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2276

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2688

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1548

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1640

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1628

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2116

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2124

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2972

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1032

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2440

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1312

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1932

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2776

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2740

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:856

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1980

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2388

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2240

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2996

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1496

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1500

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1272

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1608

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1128

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1292

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1696

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2628

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2068

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1148

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:376

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2260

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:816

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:896

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2452

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2532

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2132

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:796

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:968

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1704

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2612

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2220

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1640

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1628

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2232

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1972

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2732

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2176

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2608

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2460

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2920

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1392

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:840

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2128

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1372

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:860

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1292

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1696

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2628

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2364

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:940

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2552

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1288

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1548

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1952

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:896

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2652

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2928

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2416

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2512

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1760

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2028

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2412

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1848

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1788

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2500

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1544

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2692

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1644

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2852

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2620

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2472

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2320

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1252

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2140

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2228

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2120

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2632

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2656

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2892

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2436

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2520

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2268

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:816

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1412

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2480

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2444

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1940

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2272

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2368

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2572

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2908

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2748

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1128

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:856

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1272

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2496

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2052

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1648

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2088

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2732

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2780

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2244

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2172

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2104

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:492

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1508

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1612

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1432

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:3056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1472

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2992

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1572

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1696

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1808

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2060

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:376

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2260

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:1776

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2004

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2424

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2556

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2452

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:55 /du 9999:59 /sc daily /ri 1
2⤵
PID:2660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2512

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2216

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2908

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1608

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1820

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2604

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2608

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2680

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2848

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:340

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1492

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2320

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2140

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2504

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2324

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1300

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2072

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1200

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2132

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2384

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1996

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2988

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2844

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1128

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:3020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2148

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2464

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2620

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2152

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1744

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:744

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1804

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2296

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2268

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1796

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2556

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2308

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:680

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2180

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1544

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2772

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1720

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1980

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2124

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2008

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2164

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2692

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:916

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2464

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2852

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2152

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2336

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1148

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2196

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:684

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1796

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2512

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2680

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1548

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1920

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1500

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:3036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2732

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2244

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1932

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1492

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:3056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2340

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:748

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2436

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:324

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1776

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1868

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2424

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1996

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2704

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2208

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1916

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2856

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1516

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1472

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2948

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:744

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2260

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2520

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:684

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2060

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1412

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2256

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2316

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2232

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2888

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2496

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2008

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1228

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2576

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2140

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1028

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2424

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:820

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2028

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2708

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1500

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2396

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2888

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2956

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1544

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1080

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2760

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2408

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1296

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2504

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:328

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2152

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:964

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2436

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2552

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2520

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2708

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1788

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2440

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1724

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:676

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1980

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1076

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:892

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2360

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2128

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1372

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2088

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2404

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2652

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2308

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2412

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1920

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2756

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2180

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2888

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2104

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2408

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1392

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2432

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1572

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2140

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2484

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1560

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2060

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2276

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2740

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1564

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1516

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1648

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2616

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1812

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2180

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2828

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1492

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2464

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1932

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2324

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2596

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2068

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:2092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
2⤵
PID:1248

C:\Windows\system32\taskeng.exe
taskeng.exe {00CB66F6-2F72-41AA-AFE4-6CFA40FED8C5} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:2532

C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe
C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3032

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2284

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2836

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1496

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2116

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2052

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:2764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1740

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2312

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1156

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2784

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2444

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2416

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1848

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2840

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2388

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1956

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2168

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:492

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1984

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1432

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:884

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1292

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1952

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2736

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1728

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1976

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2792

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1704

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2176

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1508

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2192

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2892

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1664

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2928

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:760

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1332

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1312

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1272

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2456

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:340

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:932

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2580

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1264

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2688

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2448

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3048

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2000

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2556

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2512

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1548

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2748

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3020

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2780

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2732

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2620

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1576

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2644

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2480

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2452

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3016

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1712

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:1992

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1348

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1988

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2920

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1612

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:860

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2428

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2636

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1868

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1940

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1764

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1936

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2144

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2472

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:1352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2992

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2768

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2232

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2396

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1924

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:876

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2700

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2824

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2672

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2944

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2800

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2832

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2008

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3056

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2340

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1568

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:684

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1624

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2468

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1660

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2856

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:540

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2164

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1816

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1716

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1588

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:7900

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:7980

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8012

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8036

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8060

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8084

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8112

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8136

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8160

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:8184

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:600

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1040

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
- Creates scheduled task(s)
PID:3852

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2384

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2536

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:3064

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1648

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2352

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2592

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:752

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2528

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:1864

C:\Windows\system32\SCHtAsKs.EXe
"SCHtAsKs.EXe" /create /tn WindowUpdates1905249258 /tr "C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe" /st 14:56 /du 9999:59 /sc daily /ri 1
3⤵
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MicrosoftwindowsUpdates\WindowsLibrary.exe
Filesize
474KB

MD5
ec3e0e37a0706e727186ef4a1d338b48

SHA1
549d90919104da57c9ed2e6cbc3d4a654b32162b

SHA256
be9880ef9ccc6b51f6e22e21884bf7092da435c96a072bd9e9515eb88b7c6bd5

SHA512
6010946af214b0015b899f1fb1086a66a0e5d0851a35256f3294ea92e3557912cd129569220c69a4f593db37ad9027c3c7c297f904965ea9cc2e8af61a7a0862

Download Submit
memory/1096-65-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-21-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-57-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-24-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-31-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-10-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-16-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-61-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-20-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-19-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1096-14-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-63-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-33-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-23-0x0000000004400000-0x00000000044DC000-memory.dmp

Filesize
880KB

Download
memory/1096-29-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-27-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-73-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-67-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-35-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-12-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1096-39-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-37-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-47-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-45-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-25-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-41-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-75-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-71-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-69-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-59-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-55-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-53-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-51-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-49-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/1096-43-0x0000000004400000-0x00000000044D6000-memory.dmp

Filesize
856KB

Download
memory/2744-4-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/2744-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-0-0x0000000000130000-0x00000000001AA000-memory.dmp

Filesize
488KB

Download
memory/2744-22-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2744-1-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/3032-9-0x0000000001130000-0x00000000011AA000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads