73792e877293882c463aef90a5750b186399ed0995870d4cd8044df1b69a0e1a

Resubmissions

26/08/2026, 18:19

260826-wylh4s1xav10

26/08/2026, 18:15

260826-wv4khsteph10

Analysis

max time kernel
110s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WinLock.exe
Size 4.9MB
Sample260826-wv4khsteph
SHA256 73792e877293882c463aef90a5750b186399ed0995870d4cd8044df1b69a0e1a
MD5 540789e4473aa6f6024d9e912b58e18c
SHA1 ff981243bb8b9b0e33cd2474f6909b00b2620b65
SHA512 4baeba2bc405df28fbc3c6d60d8a658f54d77872b656c4981ad45567c041b2b5d6cbfe3546407de45847b96d482982cd404364655b09198ad29e87900d61427b
SSDEEP 98304:lDl9celpkV8hSJrWoNoIoLCae0ZXvgC2B/e:lLblpkV8hWrWKoIOpTfgC
TLSH
T1ED36334E5BB33A7FF02A4A392D3B29D0D5F27A485924D8CF48ACDAD445AFA420F05717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Executes dropped EXE 39 IoCs

pid	Process
2572	TCPSVCS.EXE
5840	msdt.exe
3280	PATHPING.EXE
4384	SystemPropertiesProtection.exe
5056	ndadmin.exe
3688	Fondue.exe
5108	find.exe
2092	unregmp2.exe
2552	TCPSVCS.EXE
752	TRACERT.EXE
1128	wermgr.exe
5824	sc.exe
3144	fsquirt.exe
4840	tar.exe
5112	dpnsvr.exe
5688	autochk.exe
692	cliconfg.exe
4664	tar.exe
4664	netiougc.exe
804	dpnsvr.exe
1268	cliconfg.exe
1800	TRACERT.EXE
3224	TCPSVCS.EXE
4928	fixmapi.exe
5196	cliconfg.exe
4436	tar.exe
5192	TRACERT.EXE
4604	cscript.exe
1800	ndadmin.exe
4272	wermgr.exe
2532	msdt.exe
856	dccw.exe
3332	tar.exe
4248	autochk.exe
2648	dpnsvr.exe
2676	netiougc.exe
2320	mstsc.exe
2052	TCPSVCS.EXE
5976	TCPSVCS.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\BackgroundTransferHost_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4CFA.tmp\\Logs\\BackgroundTransferHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\BackgroundTransferHost_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4CFA.tmp\\Logs\\UpdateCache\\BackgroundTransferHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\at_2 = "\"C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\at.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\perfmon_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\perfmon.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\ndadmin_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\GrantOptimize\\Logs\\UpdateCache\\UpdateCache\\ndadmin.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\fsquirt_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Logs\\UpdateCache\\UpdateCache\\fsquirt.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\where_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Mozilla\\Logs\\where.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpnsvr_3 = "\"C:\\ProgramData\\MicrosoftService\\UpdateCache\\dpnsvr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\autochk_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\InitializePing\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\autochk.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\fltMC_3 = "\"C:\\ProgramData\\MicrosoftService\\fltMC.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\rekeywiz_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4767.tmp\\Logs\\rekeywiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\sdbinst_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\acrocef_low\\Logs\\sdbinst.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\odbcad32_3 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\odbcad32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RenameShow_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RepairDebug\\UpdateCache\\RenameShow.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\attrib_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4ACD.tmp\\Logs\\attrib.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\relog_3 = "\"C:\\ProgramData\\MicrosoftService\\relog.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\fsquirt_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Logs\\fsquirt.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RenameShow_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\RepairDebug\\UpdateCache\\RenameShow.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mspaint_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD473C.tmp\\Logs\\UpdateCache\\UpdateCache\\mspaint.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtstocom_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD477E.tmp\\Logs\\UpdateCache\\mtstocom.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\autofstx_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD47D9.tmp\\Logs\\UpdateCache\\autofstx.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\InputSwitchToastHandler_3 = "\"C:\\ProgramData\\USOShared\\Logs\\UpdateCache\\UpdateCache\\InputSwitchToastHandler.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dccw_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD470E.tmp\\Logs\\dccw.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\help_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD490A.tmp\\Logs\\help.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\mstsc_5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\ReceiveSuspend\\Logs\\mstsc.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wermgr_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\StepWait\\Logs\\UpdateCache\\wermgr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\colorcpl_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4711.tmp\\Logs\\colorcpl.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\fixmapi_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\ShowOptimize\\Logs\\UpdateCache\\fixmapi.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\subst_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\hsperfdata_Admin\\Logs\\subst.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dxdiag_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD49DF.tmp\\Logs\\dxdiag.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\odbcad32_7 = "\"C:\\ProgramData\\Oracle\\Logs\\UpdateCache\\odbcad32.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\notepad_7 = "\"C:\\ProgramData\\MicrosoftService\\notepad.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\pcaui = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WinLock.exe\" -startup"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dvdplay_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD5050.tmp\\Logs\\dvdplay.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\compact_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\compact.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsmprovhost_3 = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\Logs\\wsmprovhost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CameraSettingsUIHost_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\CameraSettingsUIHost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Magnify_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4A10.tmp\\Logs\\Magnify.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\autochk_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\InitializePing\\Logs\\UpdateCache\\UpdateCache\\UpdateCache\\UpdateCache\\autochk.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dpapimig_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\dpapimig.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dvdplay_2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD5050.tmp\\Logs\\UpdateCache\\UpdateCache\\dvdplay.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunLegacyCPLElevated_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4FC1.tmp\\Logs\\RunLegacyCPLElevated.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskkill_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD47A4.tmp\\Logs\\UpdateCache\\taskkill.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\rekeywiz_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4767.tmp\\Logs\\UpdateCache\\rekeywiz.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\efsui_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD47EA.tmp\\Logs\\efsui.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dvdplay_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD5050.tmp\\Logs\\UpdateCache\\dvdplay.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\autochk_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\InitializePing\\Logs\\UpdateCache\\autochk.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RunLegacyCPLElevated_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4FC1.tmp\\Logs\\UpdateCache\\RunLegacyCPLElevated.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\msdt_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\EnableRestart\\Logs\\UpdateCache\\UpdateCache\\msdt.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\wsmprovhost_7 = "\"C:\\ProgramData\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\Logs\\UpdateCache\\UpdateCache\\wsmprovhost.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\efsui_7 = "\"C:\\ProgramData\\MicrosoftService\\efsui.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\PackagedCWALauncher_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\PackagedCWALauncher.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\PasswordOnWakeSettingFlyout_7 = "\"C:\\ProgramData\\MicrosoftService\\PasswordOnWakeSettingFlyout.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\eventvwr_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\eventvwr.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\RMActivate_ssp_isv_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD470F.tmp\\Logs\\RMActivate_ssp_isv.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4724.tmp\\Logs\\explorer.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\iexpress_6 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\UpdateCache\\iexpress.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Register-CimProvider_4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD470D.tmp\\Logs\\UpdateCache\\Register-CimProvider.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\CertEnrollCtrl_7 = "\"C:\\ProgramData\\MicrosoftService\\CertEnrollCtrl.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\dcomcnfg_2 = "\"C:\\Users\\Admin\\AppData\\Local\\MicrosoftService\\dcomcnfg.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\tasklist_8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\TCD4C9A.tmp\\Logs\\UpdateCache\\tasklist.exe\" --guard"	WinLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\TCPSVCS_1 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Logs\\TCPSVCS.EXE\" --guard"	WinLock.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2452	cmd.exe
2576	cmd.exe
3216	cmd.exe
3168	cmd.exe
2232	cmd.exe
2412	cmd.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5824	sc.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5820	cmd.exe
3628	cmd.exe
2892	cmd.exe
4144	cmd.exe
1096	cmd.exe
4896	cmd.exe
5600	Process not Found
2000	cmd.exe
2740	cmd.exe
3008	cmd.exe
4976	cmd.exe
3156	cmd.exe
2284	cmd.exe
3720	cmd.exe
2052	Process not Found
1996	cmd.exe
4664	cmd.exe
5948	cmd.exe
1840	cmd.exe
3364	cmd.exe
2720	Process not Found
4424	Process not Found
5572	cmd.exe
4052	cmd.exe
6088	cmd.exe
2292	cmd.exe
5904	cmd.exe
4232	cmd.exe
5536	cmd.exe
2572	cmd.exe
4540	cmd.exe
5796	cmd.exe
3948	Process not Found
5444	Process not Found
5436	cmd.exe
3712	cmd.exe
5780	cmd.exe
6100	cmd.exe
1200	cmd.exe
4684	cmd.exe
3552	cmd.exe
1220	cmd.exe
1404	Process not Found
2696	cmd.exe
2800	cmd.exe
1792	cmd.exe
2060	cmd.exe
3780	cmd.exe
3124	Process not Found
2324	cmd.exe
3368	cmd.exe
4724	cmd.exe
920	cmd.exe
4760	Process not Found
564	cmd.exe
2520	cmd.exe
5800	cmd.exe
5288	cmd.exe
5936	cmd.exe
3012	cmd.exe
4132	cmd.exe
4708	cmd.exe
1848	cmd.exe
2936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TCPSVCS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fsquirt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fondue.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TRACERT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 29 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1548	cmd.exe
1096	cmd.exe
5944	cmd.exe
4916	cmd.exe
1008	cmd.exe
1744	cmd.exe
1616	cmd.exe
5868	cmd.exe
3012	cmd.exe
4080	cmd.exe
3188	cmd.exe
1800	TRACERT.EXE
3032	cmd.exe
2616	cmd.exe
3144	Process not Found
5380	cmd.exe
1356	cmd.exe
4608	cmd.exe
752	TRACERT.EXE
5548	cmd.exe
5192	TRACERT.EXE
4728	cmd.exe
5348	Process not Found
2368	Process not Found
3280	PATHPING.EXE
564	cmd.exe
1684	Process not Found
3200	cmd.exe
1400	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2552	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3688	schtasks.exe
1480	schtasks.exe
4432	schtasks.exe
1348	schtasks.exe
6068	Process not Found
5840	Process not Found
1456	Process not Found
4468	schtasks.exe
3056	schtasks.exe
4712	schtasks.exe
3012	schtasks.exe
1520	schtasks.exe
5740	schtasks.exe
3940	schtasks.exe
3456	schtasks.exe
5236	schtasks.exe
3000	schtasks.exe
4632	schtasks.exe
2432	Process not Found
2940	Process not Found
2484	schtasks.exe
5688	schtasks.exe
3816	schtasks.exe
760	schtasks.exe
6068	schtasks.exe
1276	schtasks.exe
4604	Process not Found
1088	schtasks.exe
5348	schtasks.exe
3156	schtasks.exe
996	schtasks.exe
2348	schtasks.exe
3924	schtasks.exe
3384	schtasks.exe
2532	schtasks.exe
5628	Process not Found
3128	Process not Found
1512	schtasks.exe
2404	schtasks.exe
2056	schtasks.exe
692	schtasks.exe
5444	schtasks.exe
2988	schtasks.exe
5304	schtasks.exe
2728	schtasks.exe
5192	schtasks.exe
6024	schtasks.exe
5560	Process not Found
5372	schtasks.exe
2180	schtasks.exe
5460	schtasks.exe
1348	schtasks.exe
5600	schtasks.exe
5396	schtasks.exe
2320	schtasks.exe
4692	schtasks.exe
1112	schtasks.exe
5976	schtasks.exe
3484	Process not Found
2320	schtasks.exe
2396	Process not Found
5148	schtasks.exe
5000	schtasks.exe
1128	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe
5980	WinLock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	WinLock.exe
Token: SeDebugPrivilege	2552	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5980	WinLock.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 3052	5980	WinLock.exe	102
PID 5980 wrote to memory of 1996	5980	WinLock.exe	103
PID 5980 wrote to memory of 5800	5980	WinLock.exe	104
PID 5980 wrote to memory of 5944	5980	WinLock.exe	105
PID 5980 wrote to memory of 1584	5980	WinLock.exe	106
PID 5980 wrote to memory of 4556	5980	WinLock.exe	107
PID 5980 wrote to memory of 4472	5980	WinLock.exe	108
PID 5980 wrote to memory of 1484	5980	WinLock.exe	109
PID 5980 wrote to memory of 2412	5980	WinLock.exe	110
PID 5980 wrote to memory of 2232	5980	WinLock.exe	111
PID 5980 wrote to memory of 3168	5980	WinLock.exe	112
PID 5980 wrote to memory of 3216	5980	WinLock.exe	113
PID 5980 wrote to memory of 2576	5980	WinLock.exe	114
PID 5980 wrote to memory of 2452	5980	WinLock.exe	115
PID 5980 wrote to memory of 2552	5980	WinLock.exe	235
PID 3216 wrote to memory of 4748	3216	cmd.exe	196
PID 5800 wrote to memory of 4376	5800	cmd.exe	200
PID 1584 wrote to memory of 3080	1584	cmd.exe	143
PID 2232 wrote to memory of 1380	2232	cmd.exe	144
PID 4472 wrote to memory of 1792	4472	cmd.exe	145
PID 3052 wrote to memory of 5372	3052	cmd.exe	303
PID 1996 wrote to memory of 5424	1996	cmd.exe	297
PID 1484 wrote to memory of 2428	1484	cmd.exe	148
PID 4556 wrote to memory of 2348	4556	cmd.exe	149
PID 5944 wrote to memory of 1876	5944	cmd.exe	150
PID 2412 wrote to memory of 5420	2412	cmd.exe	151
PID 3168 wrote to memory of 5608	3168	cmd.exe	230
PID 5980 wrote to memory of 6120	5980	WinLock.exe	153
PID 5980 wrote to memory of 4260	5980	WinLock.exe	154
PID 5980 wrote to memory of 5412	5980	WinLock.exe	155
PID 5980 wrote to memory of 4492	5980	WinLock.exe	156
PID 5980 wrote to memory of 3120	5980	WinLock.exe	157
PID 2576 wrote to memory of 5808	2576	cmd.exe	312
PID 5980 wrote to memory of 5432	5980	WinLock.exe	159
PID 5980 wrote to memory of 6028	5980	WinLock.exe	160
PID 5980 wrote to memory of 1264	5980	WinLock.exe	161
PID 2452 wrote to memory of 1960	2452	cmd.exe	170
PID 1264 wrote to memory of 1472	1264	cmd.exe	171
PID 5980 wrote to memory of 2572	5980	WinLock.exe	302
PID 3216 wrote to memory of 2900	3216	cmd.exe	173
PID 4260 wrote to memory of 4612	4260	cmd.exe	233
PID 6120 wrote to memory of 3096	6120	cmd.exe	176
PID 6028 wrote to memory of 3676	6028	cmd.exe	177
PID 5412 wrote to memory of 3884	5412	cmd.exe	178
PID 4492 wrote to memory of 4128	4492	cmd.exe	179
PID 2232 wrote to memory of 716	2232	cmd.exe	180
PID 5432 wrote to memory of 2784	5432	cmd.exe	182
PID 3120 wrote to memory of 2824	3120	cmd.exe	238
PID 3168 wrote to memory of 2600	3168	cmd.exe	185
PID 2412 wrote to memory of 240	2412	cmd.exe	186
PID 2452 wrote to memory of 480	2452	cmd.exe	187
PID 2576 wrote to memory of 4828	2576	cmd.exe	315
PID 5980 wrote to memory of 2668	5980	WinLock.exe	193
PID 5980 wrote to memory of 4676	5980	WinLock.exe	194
PID 5980 wrote to memory of 2756	5980	WinLock.exe	195
PID 5980 wrote to memory of 4748	5980	WinLock.exe	196
PID 5980 wrote to memory of 2844	5980	WinLock.exe	197
PID 5980 wrote to memory of 1368	5980	WinLock.exe	198
PID 5980 wrote to memory of 5436	5980	WinLock.exe	199
PID 5980 wrote to memory of 4376	5980	WinLock.exe	200
PID 4376 wrote to memory of 2072	4376	cmd.exe	210
PID 4748 wrote to memory of 120	4748	cmd.exe	211
PID 2844 wrote to memory of 6064	2844	cmd.exe	212
PID 1368 wrote to memory of 2740	1368	cmd.exe	213

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1960	attrib.exe
2900	attrib.exe
480	attrib.exe
240	attrib.exe
716	attrib.exe
2600	attrib.exe
4828	attrib.exe
5608	attrib.exe
4748	attrib.exe
1380	attrib.exe
5420	attrib.exe
5808	attrib.exe

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5424
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:5420
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:240
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1380
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5608
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2600
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4748
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5808
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @angel1cSup 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:1960
- - C:\Windows\SysWOW64\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:480
- C:\Windows\SysWOW64\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4612
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpscript_3" /tr ""C:\ProgramData\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpscript_3" /tr ""C:\ProgramData\MicrosoftService\gpscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A6.tmp\Logs\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A6.tmp\Logs\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2784
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_7" /tr ""C:\ProgramData\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_7" /tr ""C:\ProgramData\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1472
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\TCPSVCS.EXE
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\TCPSVCS.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\wermgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\wermgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6064
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3040
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4648
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_3" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CloudNotifications_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ADF.tmp\Logs\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CloudNotifications_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ADF.tmp\Logs\CloudNotifications.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1344
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3428
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5024
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3188
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DWWIN_3" /tr ""C:\ProgramData\MicrosoftService\DWWIN.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DWWIN_3" /tr ""C:\ProgramData\MicrosoftService\DWWIN.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventcreate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\eventcreate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventcreate_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\eventcreate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\mstsc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\mstsc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fsutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\fsutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3104
- C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\TRACERT.EXE
  "C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\TRACERT.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2852
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_3" /tr ""C:\ProgramData\MicrosoftService\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_3" /tr ""C:\ProgramData\MicrosoftService\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WWAHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AE.tmp\Logs\WWAHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WWAHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AE.tmp\Logs\WWAHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:868
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_recover_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_recover_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\recover.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\MicrosoftService\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\MicrosoftService\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4084
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1244
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3132
- C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\wermgr.exe
  "C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\wermgr.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\instnm.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_instnm_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\instnm.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4724.tmp\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4724.tmp\Logs\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Robocopy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD481B.tmp\Logs\Robocopy.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5372
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Robocopy_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD481B.tmp\Logs\Robocopy.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4468
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetShow\Logs\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetShow\Logs\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchWinApp_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A6.tmp\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchWinApp_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A6.tmp\Logs\UpdateCache\LaunchWinApp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_3" /tr ""C:\ProgramData\MicrosoftService\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_3" /tr ""C:\ProgramData\MicrosoftService\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Magnify_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD514C.tmp\Logs\Magnify.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Magnify_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD514C.tmp\Logs\Magnify.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_chkdsk_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\chkdsk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_chkdsk_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\chkdsk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6012
- C:\Users\Admin\AppData\Roaming\ResetShow\Logs\sc.exe
  "C:\Users\Admin\AppData\Roaming\ResetShow\Logs\sc.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - Launches sc.exe
  PID:5824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RenameShow_1" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RenameShow_1" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PackagedCWALauncher_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PackagedCWALauncher_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\PackagedCWALauncher.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_takeown_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD495C.tmp\Logs\takeown.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_takeown_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD495C.tmp\Logs\takeown.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1240
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_7" /tr ""C:\ProgramData\MicrosoftService\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PasswordOnWakeSettingFlyout_7" /tr ""C:\ProgramData\MicrosoftService\PasswordOnWakeSettingFlyout.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1500
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3292
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4152
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\Logs\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icsunattend_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icsunattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icsunattend_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icsunattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:468
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_BackgroundTransferHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4CFA.tmp\Logs\BackgroundTransferHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4048
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_BackgroundTransferHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4CFA.tmp\Logs\BackgroundTransferHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5272
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2400
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setupugc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{B516D645-5DCC-4978-B0DD-8FBB3CADACF1}\Logs\setupugc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setupugc_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{B516D645-5DCC-4978-B0DD-8FBB3CADACF1}\Logs\setupugc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wecutil_7" /tr ""C:\ProgramData\MicrosoftService\wecutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wecutil_7" /tr ""C:\ProgramData\MicrosoftService\wecutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventcreate_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\eventcreate.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventcreate_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\Logs\UpdateCache\eventcreate.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5284
- C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3144
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_3" /tr ""C:\ProgramData\MicrosoftService\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1500
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_3" /tr ""C:\ProgramData\MicrosoftService\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4711.tmp\Logs\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4711.tmp\Logs\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_6" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4276
- C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\tar.exe
  "C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\tar.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2084
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Fondue_3" /tr ""C:\ProgramData\Microsoft OneDrive\Logs\UpdateCache\UpdateCache\Fondue.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\614646637\Logs\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\614646637\Logs\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\regini.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\regini.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4769.tmp\Logs\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4504
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4769.tmp\Logs\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\dpnsvr.exe
  "C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\dpnsvr.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_vcredist_x64_3" /tr ""C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_vcredist_x64_3" /tr ""C:\ProgramData\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\UpdateCache\vcredist_x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wscadminui_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4D79.tmp\Logs\wscadminui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wscadminui_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4D79.tmp\Logs\wscadminui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_7" /tr ""C:\ProgramData\MicrosoftService\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4848
- C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\autochk.exe
  "C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\autochk.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_5" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_5" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4228
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\openfiles.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\openfiles.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rasautou_7" /tr ""C:\ProgramData\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rasautou_7" /tr ""C:\ProgramData\MicrosoftService\rasautou.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4769.tmp\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4769.tmp\Logs\UpdateCache\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\perfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\perfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_attrib_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ACD.tmp\Logs\attrib.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_attrib_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ACD.tmp\Logs\attrib.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_BackgroundTransferHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4CFA.tmp\Logs\UpdateCache\BackgroundTransferHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_BackgroundTransferHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4CFA.tmp\Logs\UpdateCache\BackgroundTransferHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_7" /tr ""C:\ProgramData\MicrosoftService\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_7" /tr ""C:\ProgramData\MicrosoftService\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5368
- C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\tar.exe
  "C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\tar.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_unregmp2_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_unregmp2_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5200
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:120
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:920
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4767.tmp\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4767.tmp\Logs\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_1" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_1" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3688
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regini_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regini_3" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3640
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3884
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3012
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2280
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_7" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1344
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PresentationHost_7" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4B5E.tmp\Logs\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4B5E.tmp\Logs\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4356
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5744
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TapiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\TapiUnattend.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TapiUnattend_3" /tr ""C:\ProgramData\MicrosoftService\TapiUnattend.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autofstx_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47D9.tmp\Logs\autofstx.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autofstx_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47D9.tmp\Logs\autofstx.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1076
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\sdchange.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3516
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1980
- C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\netiougc.exe
  "C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\netiougc.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1356
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mspaint_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mspaint_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473C.tmp\Logs\UpdateCache\UpdateCache\mspaint.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5396
- C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe
  "C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3164
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_AtBroker_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\AtBroker.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_AtBroker_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\AtBroker.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4216
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5776
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TpmTool_7" /tr ""C:\ProgramData\MicrosoftService\TpmTool.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TpmTool_7" /tr ""C:\ProgramData\MicrosoftService\TpmTool.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_3" /tr ""C:\ProgramData\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3008
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_3" /tr ""C:\ProgramData\MicrosoftService\efsui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:424
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1652
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmdl32_7" /tr ""C:\ProgramData\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5368
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmdl32_7" /tr ""C:\ProgramData\MicrosoftService\cmdl32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1364
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2900
- C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE
  "C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdchange_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autofstx_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47D9.tmp\Logs\UpdateCache\autofstx.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autofstx_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47D9.tmp\Logs\UpdateCache\autofstx.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4711.tmp\Logs\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4711.tmp\Logs\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:804
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fixmapi_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fixmapi_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\UpdateCache\fixmapi.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:788
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5428
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InfDefaultInstall_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4712.tmp\Logs\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InfDefaultInstall_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4712.tmp\Logs\InfDefaultInstall.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CameraSettingsUIHost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\CameraSettingsUIHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CameraSettingsUIHost_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\CameraSettingsUIHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4712
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setup_7" /tr ""C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\UpdateCache\UpdateCache\setup.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4725.tmp\Logs\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5148
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4725.tmp\Logs\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5484
- C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\UpdateCache\fixmapi.exe
  "C:\Users\Admin\AppData\Roaming\ShowOptimize\Logs\UpdateCache\fixmapi.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SpatialAudioLicenseSrv_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\SpatialAudioLicenseSrv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WinRTNetMUAHostServer_3" /tr ""C:\ProgramData\MicrosoftService\WinRTNetMUAHostServer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WinRTNetMUAHostServer_3" /tr ""C:\ProgramData\MicrosoftService\WinRTNetMUAHostServer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD485C.tmp\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4804
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4336
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3400
- C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5836
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1220
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_curl_3" /tr ""C:\ProgramData\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_curl_3" /tr ""C:\ProgramData\MicrosoftService\curl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2016
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Magnify_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4A10.tmp\Logs\Magnify.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Magnify_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4A10.tmp\Logs\Magnify.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_psr_7" /tr ""C:\ProgramData\MicrosoftService\psr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_psr_7" /tr ""C:\ProgramData\MicrosoftService\psr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47A4.tmp\Logs\UpdateCache\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2528
- C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe
  "C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_1" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2604
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:596
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_diskusage_7" /tr ""C:\ProgramData\MicrosoftService\diskusage.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_diskusage_7" /tr ""C:\ProgramData\MicrosoftService\diskusage.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4896
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2488
- C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE
  "C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5192
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_1" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_1" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2416
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\614646637\Logs\UpdateCache\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_4" /tr ""C:\Users\Admin\AppData\Local\Temp\614646637\Logs\UpdateCache\RMActivate_ssp.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2284
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\MicrosoftService\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\MicrosoftService\sdchange.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1492
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5784
- C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe
  "C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_1" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_1" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfmon_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\perfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfmon_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\perfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2520
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_relog_3" /tr ""C:\ProgramData\MicrosoftService\relog.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_relog_3" /tr ""C:\ProgramData\MicrosoftService\relog.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD5050.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_6" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_notepad_7" /tr ""C:\ProgramData\MicrosoftService\notepad.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2016
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_notepad_7" /tr ""C:\ProgramData\MicrosoftService\notepad.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe
  "C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wermgr_1" /tr ""C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\UpdateCache\wermgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_2" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3616
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dvdplay_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD476B.tmp\Logs\UpdateCache\dvdplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5236
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dtdump_7" /tr ""C:\ProgramData\MicrosoftService\dtdump.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dtdump_7" /tr ""C:\ProgramData\MicrosoftService\dtdump.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rekeywiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4767.tmp\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rekeywiz_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4767.tmp\Logs\UpdateCache\rekeywiz.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2528
- C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\UpdateCache\wermgr.exe
  "C:\Users\Admin\AppData\Roaming\StepWait\Logs\UpdateCache\UpdateCache\UpdateCache\wermgr.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_1" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_1" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WWAHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AE.tmp\Logs\UpdateCache\WWAHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WWAHost_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AE.tmp\Logs\UpdateCache\WWAHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_iexpress_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\iexpress.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdchange_7" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2168
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4768.tmp\Logs\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4064
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_xcopy_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_xcopy_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5460
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_5" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2296
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_compact_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_compact_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\compact.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mountvol_7" /tr ""C:\ProgramData\MicrosoftService\mountvol.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4656
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mountvol_7" /tr ""C:\ProgramData\MicrosoftService\mountvol.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5392
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3352
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_newdev_3" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\newdev.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2736
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_poqexec_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473D.tmp\Logs\poqexec.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_poqexec_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473D.tmp\Logs\poqexec.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4088
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_MRINFO_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MRINFO.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5056
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_MRINFO_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\MRINFO.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5196
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_7" /tr ""C:\ProgramData\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3164
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_7" /tr ""C:\ProgramData\MicrosoftService\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4124
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5732
- C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe
  "C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_1" /tr ""C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_1" /tr ""C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_icacls_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\icacls.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cmmon32_3" /tr ""C:\ProgramData\MicrosoftService\cmmon32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3416
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cmmon32_3" /tr ""C:\ProgramData\MicrosoftService\cmmon32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2548
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_5" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_6" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_7" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_openfiles_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_openfiles_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4680
- C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\dccw.exe
  "C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\dccw.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3924
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fontview_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_5" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6100
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesComputerName_7" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesComputerName.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesComputerName_7" /tr ""C:\ProgramData\MicrosoftService\SystemPropertiesComputerName.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4B5E.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4B5E.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe
  "C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1224
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2532
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4572
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_subst_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\subst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_subst_4" /tr ""C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\Logs\subst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1404
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3400
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_5" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4080
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_label_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\label.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_label_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\label.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3440
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_setx_7" /tr ""C:\ProgramData\MicrosoftService\setx.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5484
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_setx_7" /tr ""C:\ProgramData\MicrosoftService\setx.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dxdiag_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49DF.tmp\Logs\dxdiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dxdiag_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49DF.tmp\Logs\dxdiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_1" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_label_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\label.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2516
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_label_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\label.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dcomcnfg_3" /tr ""C:\ProgramData\MicrosoftService\dcomcnfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5848
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dcomcnfg_3" /tr ""C:\ProgramData\MicrosoftService\dcomcnfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5984
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_autochk_5" /tr ""C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3852
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:856
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CertEnrollCtrl_7" /tr ""C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5276
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CertEnrollCtrl_7" /tr ""C:\ProgramData\MicrosoftService\CertEnrollCtrl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3256
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CheckNetIsolation_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CheckNetIsolation_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5840
- C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\autochk.exe
  "C:\Users\Admin\AppData\Roaming\InitializePing\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\autochk.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RenameShow_1" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RenameShow_1" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4544
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_svchost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_svchost_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\svchost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PresentationHost_3" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PresentationHost_3" /tr ""C:\ProgramData\MicrosoftService\PresentationHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_openfiles_4" /tr ""C:\Users\Admin\AppData\Local\Temp\Low\Logs\UpdateCache\UpdateCache\UpdateCache\openfiles.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5600
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_colorcpl_5" /tr ""C:\Users\Admin\AppData\Roaming\PingGet\Logs\UpdateCache\UpdateCache\colorcpl.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:8
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3700
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1224
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_5" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5264
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4380
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3616
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_7" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5020
- C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe
  "C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetShow\Logs\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResetShow\Logs\UpdateCache\sc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dcomcnfg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dcomcnfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2884
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dcomcnfg_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dcomcnfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\UpdateCache\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\UpdateCache\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:760
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4136
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sfc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sfc_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\sfc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ftp_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ftp_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_convert_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD492B.tmp\Logs\convert.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_convert_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD492B.tmp\Logs\convert.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4544
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_at_2" /tr ""C:\Users\Admin\AppData\Local\PeerDistRepub\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\at.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3780
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2264
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdchange_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RMActivate_ssp_isv_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RMActivate_ssp_isv_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470F.tmp\Logs\UpdateCache\UpdateCache\RMActivate_ssp_isv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_7" /tr ""C:\ProgramData\MicrosoftService\msra.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_7" /tr ""C:\ProgramData\MicrosoftService\msra.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5740
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2488
- C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe
  "C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mstsc_1" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mstsc_1" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RdpSa_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5200
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RdpSa_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\RdpSa.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_odbcad32_3" /tr ""C:\ProgramData\Oracle\Logs\UpdateCache\UpdateCache\UpdateCache\odbcad32.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_explorer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4724.tmp\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2044
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_explorer_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4724.tmp\Logs\UpdateCache\explorer.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mstsc_5" /tr ""C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\mstsc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_perfmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\perfmon.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5108
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_perfmon_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\UpdateCache\perfmon.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:944
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4964
- C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\UpdateCache\mstsc.exe
  "C:\Users\Admin\AppData\Roaming\ReceiveSuspend\Logs\UpdateCache\UpdateCache\mstsc.exe" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3512
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_windowsdesktop-runtime-8.0.15-win-x64_3" /tr ""C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\UpdateCache\windowsdesktop-runtime-8.0.15-win-x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_PATHPING_4" /tr ""C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\UpdateCache\PATHPING.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_5" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3812
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_7" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_attrib_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ACD.tmp\Logs\UpdateCache\attrib.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_attrib_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4ACD.tmp\Logs\UpdateCache\attrib.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2720
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\TCPSVCS.EXE
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\UpdateCache\TCPSVCS.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TCPSVCS_1" /tr ""C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_DevicePairingWizard_2" /tr ""C:\Users\Admin\AppData\Local\D3DSCache\Logs\UpdateCache\UpdateCache\DevicePairingWizard.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_3" /tr ""C:\ProgramData\MicrosoftService\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wevtutil_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wevtutil_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD478E.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\wevtutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cscript_5" /tr ""C:\Users\Admin\AppData\Roaming\NewSubmit\Logs\UpdateCache\cscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2432
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5560
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_rdrleakdiag_7" /tr ""C:\ProgramData\MicrosoftService\rdrleakdiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:6100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_rdrleakdiag_7" /tr ""C:\ProgramData\MicrosoftService\rdrleakdiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdbinst_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\sdbinst.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_sdbinst_8" /tr ""C:\Users\Admin\AppData\Local\Temp\acrocef_low\Logs\sdbinst.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1384
- C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE
  "C:\Users\Admin\AppData\Roaming\Microsoft\Logs\UpdateCache\UpdateCache\TCPSVCS.EXE" --watchdog-slave
  2⤵
  - Executes dropped EXE
  PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msdt_1" /tr ""C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\UpdateCache\UpdateCache\msdt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6068
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpapimig_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dpapimig.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:5572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpapimig_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\dpapimig.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4928
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SearchFilterHost_3" /tr ""C:\ProgramData\ssh\Logs\UpdateCache\UpdateCache\SearchFilterHost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2900
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4052
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_find_6" /tr ""C:\Users\Admin\AppData\Local\Packages\Logs\UpdateCache\find.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_msra_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_msra_7" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_efsui_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47EA.tmp\Logs\efsui.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:4896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_efsui_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47EA.tmp\Logs\efsui.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_netiougc_1" /tr ""C:\Users\Admin\AppData\Roaming\ResizeHide\Logs\UpdateCache\UpdateCache\netiougc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5304
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3096
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_OpenWith_3" /tr ""C:\ProgramData\MicrosoftService\OpenWith.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_OpenWith_3" /tr ""C:\ProgramData\MicrosoftService\OpenWith.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5672
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4756.tmp\Logs\gpscript.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpscript_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4756.tmp\Logs\gpscript.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3444
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_5" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_taskkill_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\taskkill.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_taskkill_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\taskkill.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2180
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4072
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regedit_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regedit_8" /tr ""C:\Users\Admin\AppData\Local\Temp\Outlook Logging\Logs\regedit.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3140
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_1" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_2" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:792
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ktmutil_3" /tr ""C:\ProgramData\regid.1991-06.com.microsoft\Logs\UpdateCache\ktmutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ddodiag_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\ddodiag.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ddodiag_4" /tr ""C:\Users\Admin\AppData\Local\Temp\VBE\Logs\ddodiag.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5988
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tar_5" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tar_5" /tr ""C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_VC_redist.x64_7" /tr ""C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\UpdateCache\VC_redist.x64.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1328
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1048
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_LaunchTM_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD47C7.tmp\Logs\UpdateCache\LaunchTM.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5504
- C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe
  "C:\Users\Admin\AppData\Roaming\BlockConvert\Logs\UpdateCache\UpdateCache\tar.exe" --watchdog-slave
  2⤵
  PID:3940
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3812
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_1" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tasklist_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:3780
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tasklist_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4C9A.tmp\Logs\UpdateCache\UpdateCache\tasklist.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5396
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_3" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1268
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4632
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_6" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4604
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:236
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5324
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\UpdateCache\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD490A.tmp\Logs\UpdateCache\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1188
- C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe
  "C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\choice.exe" --watchdog-slave
  2⤵
  PID:5768
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dllhost_1" /tr ""C:\Users\Admin\AppData\Roaming\ShowCompare\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\dllhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:716
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_win32calc_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\win32calc.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_GameBarPresenceWriter_3" /tr ""C:\ProgramData\MicrosoftService\GameBarPresenceWriter.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3348
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_GameBarPresenceWriter_3" /tr ""C:\ProgramData\MicrosoftService\GameBarPresenceWriter.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RunLegacyCPLElevated_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4FC1.tmp\Logs\UpdateCache\UpdateCache\RunLegacyCPLElevated.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5816
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_cliconfg_5" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1276
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_replace_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_replace_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\replace.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4044
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_7" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3808
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_ndadmin_1" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_ndadmin_1" /tr ""C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Register-CimProvider_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Register-CimProvider_2" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470D.tmp\Logs\UpdateCache\Register-CimProvider.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2384
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mcbuilder_3" /tr ""C:\ProgramData\MicrosoftService\mcbuilder.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mcbuilder_3" /tr ""C:\ProgramData\MicrosoftService\mcbuilder.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5804
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_SystemPropertiesProtection_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_SystemPropertiesProtection_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\UpdateCache\UpdateCache\SystemPropertiesProtection.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3176
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_choice_5" /tr ""C:\Users\Admin\AppData\Roaming\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\choice.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_6" /tr ""C:\Users\Admin\AppData\Local\Google\Logs\UpdateCache\UpdateCache\UpdateCache\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5720
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4092
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD470E.tmp\Logs\UpdateCache\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5840
- C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe
  "C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\UpdateCache\UpdateCache\ndadmin.exe" --watchdog-slave
  2⤵
  PID:5148
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_WPDShextAutoplay_1" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_WPDShextAutoplay_1" /tr ""C:\Users\Admin\AppData\Roaming\RevokeWrite\Logs\UpdateCache\UpdateCache\WPDShextAutoplay.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_where_2" /tr ""C:\Users\Admin\AppData\Local\Mozilla\Logs\UpdateCache\UpdateCache\where.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3336
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_reg_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_reg_3" /tr ""C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_help_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\UpdateCache\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_help_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD473E.tmp\Logs\UpdateCache\UpdateCache\help.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3456
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:996
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_RenameShow_5" /tr ""C:\Users\Admin\AppData\Roaming\RepairDebug\UpdateCache\RenameShow.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2552
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\lodctr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_lodctr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\lodctr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:752
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fltMC_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fltMC_7" /tr ""C:\ProgramData\MicrosoftService\UpdateCache\fltMC.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:6092
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_Magnify_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD514C.tmp\Logs\UpdateCache\Magnify.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_Magnify_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD514C.tmp\Logs\UpdateCache\Magnify.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4172
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
  2⤵
  - Executes a command shell one-liner
  PID:1840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_fsquirt_1" /tr ""C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_eventvwr_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2256
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_eventvwr_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\UpdateCache\eventvwr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_InputSwitchToastHandler_3" /tr ""C:\ProgramData\USOShared\Logs\UpdateCache\UpdateCache\InputSwitchToastHandler.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_winver_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\winver.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_winver_4" /tr ""C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\Logs\winver.exe" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_TRACERT_5" /tr ""C:\Users\Admin\AppData\Roaming\SearchGrant\Logs\UpdateCache\TRACERT.EXE" --task" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2320
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_bthudtask_6" /tr ""C:\Users\Admin\AppData\Local\ConnectedDevicesPlatform\Logs\UpdateCache\bthudtask.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4332
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2416
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_regini_7" /tr ""C:\ProgramData\Packages\Logs\UpdateCache\UpdateCache\regini.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4725.tmp\Logs\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5804
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_grpconv_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4725.tmp\Logs\UpdateCache\grpconv.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:2504
- C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe
  "C:\Users\Admin\AppData\Roaming\Sun\Logs\UpdateCache\UpdateCache\fsquirt.exe" --watchdog-slave
  2⤵
  PID:1112
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dpnsvr_1" /tr ""C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:4704
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tzutil.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_tzutil_2" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\tzutil.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3588
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_gpresult_3" /tr ""C:\ProgramData\MicrosoftService\gpresult.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4340
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_gpresult_3" /tr ""C:\ProgramData\MicrosoftService\gpresult.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\UpdateCache\UpdateCache\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:6004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_CheckNetIsolation_4" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD4F61.tmp\Logs\UpdateCache\UpdateCache\CheckNetIsolation.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_dccw_5" /tr ""C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4272
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_dccw_5" /tr ""C:\Users\Admin\AppData\Roaming\RestoreResolve\Logs\UpdateCache\dccw.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1128
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wermgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wermgr.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:2488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wermgr_6" /tr ""C:\Users\Admin\AppData\Local\MicrosoftService\wermgr.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:5300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_wsmprovhost_7" /tr ""C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\Logs\UpdateCache\UpdateCache\wsmprovhost.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5184
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4172
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "WinTask_mtstocom_8" /tr ""C:\Users\Admin\AppData\Local\Temp\TCD477E.tmp\Logs\UpdateCache\UpdateCache\UpdateCache\mtstocom.exe" --task" /sc onlogon /rl highest /f
    3⤵
    PID:5000
- C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe
  "C:\Users\Admin\AppData\Roaming\UninstallStart\Logs\UpdateCache\UpdateCache\dpnsvr.exe" --watchdog-slave
  2⤵
  PID:2676
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_cliconfg_1" /tr ""C:\Users\Admin\AppData\Roaming\Mozilla\Logs\UpdateCache\UpdateCache\cliconfg.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4532
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_fontview_2" /tr ""C:\Users\Admin\AppData\Local\Adobe\Logs\UpdateCache\UpdateCache\UpdateCache\fontview.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:3816
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "WinTask_sdchange_3" /tr ""C:\ProgramData\SoftwareDistribution\Logs\UpdateCache\UpdateCache\sdchange.exe" --task" /sc onlogon /rl highest /f
  2⤵
  PID:4756

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" -startup
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe"
1⤵
PID:4664

C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\msdt.exe
"C:\Users\Admin\AppData\Roaming\EnableRestart\Logs\msdt.exe" --guard
1⤵
- Executes dropped EXE
PID:5840

C:\Users\Admin\AppData\Local\Temp\WinLock.exe
"C:\Users\Admin\AppData\Local\Temp\WinLock.exe" --guard
1⤵
PID:1364

C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\PATHPING.EXE
"C:\Users\Admin\AppData\Local\Temp\{05D77BED-53C3-4F6B-8089-D17FF23873EF}\Logs\PATHPING.EXE" --guard
1⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
PID:3280

C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\ndadmin.exe
"C:\Users\Admin\AppData\Roaming\GrantOptimize\Logs\ndadmin.exe" --guard
1⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\SystemPropertiesProtection.exe
"C:\Users\Admin\AppData\Local\Temp\TCD49AC.tmp\Logs\SystemPropertiesProtection.exe" --guard
1⤵
- Executes dropped EXE
PID:4384

C:\ProgramData\Microsoft OneDrive\Logs\Fondue.exe
"C:\ProgramData\Microsoft OneDrive\Logs\Fondue.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3688

C:\Users\Admin\AppData\Local\Packages\Logs\find.exe
"C:\Users\Admin\AppData\Local\Packages\Logs\find.exe" --guard
1⤵
- Executes dropped EXE
PID:5108

C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe
"C:\Users\Admin\AppData\Local\MicrosoftService\unregmp2.exe" --guard
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TCPSVCS.EXE

Path C:\Users\Admin\AppData\Roaming\Microsoft\Logs\TCPSVCS.EXE
Size 4.9MB
SHA256 73792e877293882c463aef90a5750b186399ed0995870d4cd8044df1b69a0e1a
MD5 540789e4473aa6f6024d9e912b58e18c
SHA1 ff981243bb8b9b0e33cd2474f6909b00b2620b65
SHA512 4baeba2bc405df28fbc3c6d60d8a658f54d77872b656c4981ad45567c041b2b5d6cbfe3546407de45847b96d482982cd404364655b09198ad29e87900d61427b
SSDEEP 98304:lDl9celpkV8hSJrWoNoIoLCae0ZXvgC2B/e:lLblpkV8hWrWKoIOpTfgC
TLSH
T1ED36334E5BB33A7FF02A4A392D3B29D0D5F27A485924D8CF48ACDAD445AFA420F05717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winlock_debug.log

Path C:\Users\Admin\Desktop\winlock_debug.log
Size 506B
SHA256 c5622106735b6b5cb3598f60de4b3e815bdb248e5283af515dc3135b5cba89c0
MD5 d623ff305439fc16590c336941fdb6f2
SHA1 d0380f6a020becdea68b72b1db0606ecf9f94e36
SHA512 990c91afdae4decd16c3bd35f8b204f653848786b40c1b668e9720e2ce9e47e87a993a395f83a29821be3414c1e55908c9a2f504af009c1dc38a86497240c750
TLSH
T1BBF097F407FD05E70C7B006EC13E8E5222A33BE18649CD9A325A88D036D5A0C0BCB730
MD5 SHA1 SHA512 TLSH

Submit Download

winlock_debug.log

Path C:\Users\Admin\Desktop\winlock_debug.log
Size 593B
SHA256 ef744aa8efaec82b7e54afe6b6e5cf5ec1e767f3d59f820b2df216fb7049ca3d
MD5 b145b4458545cde13f6f60f524ff0fc5
SHA1 b59a8e65778da026e05cb60d6502a8c23eddd709
SHA512 da72322987c26f16d7faec682c7dfd0eab5fb1566495d43198a9248739c8d5f8e051a690cc7c5c84e1c67b1b29700c638365e1b33865193f147cdbb8019ea13b
TLSH
T130F08BF807FD05E74DBA005EC23E4E51726337E18689DD9A319A84D036E6A0C0BCB730
MD5 SHA1 SHA512 TLSH

Submit Download

winlock_debug.log

Path C:\Users\Admin\Desktop\winlock_debug.log
Size 680B
SHA256 bbc6c317bbda6180599432262c339a638486f3c7cb95010b2fb08d92e59d1322
MD5 a21820d58691a8db92a33e173a5eb122
SHA1 28aea5f7a45a8896bad3aa371e39d523beb3d68a
SHA512 8d9f605400a9d088133842d2c671f475018e68fd59b97c9d56c23f5720aa4e8a78b3b6a34cca24854786ab5a4f99c53674dae3e036adce7d7a41977a505eb117
TLSH
T11A014EE807FD05F78DBA005EC13D4E51725337E18645DD8A719A84D036E650C0BDB731
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 78B
SHA256 56d1e1d9ee5b987f1a860ad37bc88af64833d76d262141ed296c45febb29806a
MD5 58e37a5ec27bcf32d2c97ed419c4bbd7
SHA1 af00a8614353d0201b5bbc591db7b536fc3aa24d
SHA512 80fde3d290f30e467df6668cc450ac8bac692f55176d6cd8bfecccf699876738951f8b639de45c00bdb0462b907f358576a07b7bc55deec37b41c61753d84276
TLSH
T1C7A012442C181948110110F33472B00124BC945C901325C1620000920010090189A564
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\info-Locker.txt
Size 78B
SHA256 50367f212b66e0eaa1f38df5e094b96838011696037a182825c2c1c859219cba
MD5 89484f890c07f5c31d9a28fd8068ff70
SHA1 4eb55a41ccbcda5606f7a313bb2b6635fa1adc21
SHA512 b58015f406ba46620876c3b5b43952c17aa06ce9b1f3a4c8f2be6480208fa2a8234f1ad7fa10e82601045a9145b332f4c111d8a5363f3712828044961f7ad1b5
TLSH
T1CCA011882C282288200020F238B3B02228BEA88EA0032A82820000A202200A028AA820
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2616-29-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/2616-32-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5980-2-0x0000000005280000-0x000000000531C000-memory.dmp

Download

memory/5980-19-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5980-3-0x0000000005930000-0x0000000005EEA000-memory.dmp

Download

memory/5980-11-0x0000000008DA0000-0x0000000008E06000-memory.dmp

Download

memory/5980-4-0x0000000005410000-0x00000000054A2000-memory.dmp

Download

memory/5980-9-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5980-1-0x00000000002A0000-0x0000000000784000-memory.dmp

Download

memory/5980-0-0x0000000074372000-0x0000000074373000-memory.dmp

Download

memory/5980-8-0x00000000054B0000-0x0000000005506000-memory.dmp

Download

memory/5980-7-0x0000000005340000-0x000000000534A000-memory.dmp

Download

memory/5980-79-0x0000000074372000-0x0000000074373000-memory.dmp

Download

memory/5980-98-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download

memory/5980-112-0x0000000074360000-0x0000000074B1C000-memory.dmp

Download