sheetrat | 82d7af76c1305cffcd7925c62b5f1d525f446be09509fea7881fdeaec700c710

Analysis

max time kernel
899s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 322KB
Sample260913-r2rr3szzev
SHA256 82d7af76c1305cffcd7925c62b5f1d525f446be09509fea7881fdeaec700c710
MD5 118d9ea9e434d6ae0262c3b52f956ec3
SHA1 4f1f05a8e68f16747e1c9ece4c7ddc49f15e2ae0
SHA512 09749b01b9b7398e67e12abbfcdef2e104e592304a9acaf51ec34a6b6e89175ea798e61ce022346c7fb1779a59c282bfdd9b397fabd9624bc30933ecbae61f77
SSDEEP 6144:CAblEYQHiXpMPVoe6VlWT8b9yDxgrwTW/N+b2BWQ:/mVS6ePVle8Imay5BR
TLSH
T17864D50CFE81E805DE5E3D77CBE610008B7125C22E22928676596FFD8B5637758E62BC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sheet_qwrqrmioqhvabi execution sheetrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

sheetrat

Version

Campaign

Sheet_qwrqrmioqhvabi

64.188.118.59:4444

Signatures

Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
trojan sheetrat

Detects Sheetrat obfuscated V1.8 and higher 1 IoCs

Sheetrat aka NonEuclid RAT is a trojan written in C#.

resource	yara_rule
behavioral1/memory/4128-0-0x00000000002A0000-0x00000000002F6000-memory.dmp	family_sheetrat_v4

Detects Sheetrat obfuscated version 1 IoCs

resource	yara_rule
behavioral1/memory/4128-0-0x00000000002A0000-0x00000000002F6000-memory.dmp	Sheetrat_v5

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Documents\\MATLAB.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Wireshark Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Wireshark Host.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	Wireshark Host.exe

Executes dropped EXE 7 IoCs

pid	Process
3048	MATLAB.exe
5084	Wireshark Host.exe
4568	MATLAB.exe
5896	Wireshark Host.exe
1636	MATLAB.exe
4236	Wireshark Host.exe
5100	MATLAB.exe

Loads dropped DLL 64 IoCs

pid	Process
5796	Process not Found
3860	Process not Found
3168	Process not Found
3048	MATLAB.exe
1108	Process not Found
5432	Process not Found
5952	Process not Found
5156	Process not Found
2512	Process not Found
3036	Process not Found
2092	Process not Found
5752	Process not Found
3856	Process not Found
116	Process not Found
1500	Process not Found
5232	Process not Found
3944	Process not Found
2416	Process not Found
2160	Process not Found
4448	Process not Found
5280	Process not Found
2256	Process not Found
1588	Process not Found
2132	Process not Found
1720	Process not Found
5352	Process not Found
5388	Process not Found
3680	Process not Found
2284	Process not Found
1276	Process not Found
4036	Process not Found
5764	Process not Found
1104	Process not Found
4924	Process not Found
4636	Process not Found
2108	Process not Found
2392	Process not Found
3148	Process not Found
2364	Process not Found
3396	Process not Found
5596	Process not Found
3240	Process not Found
2900	Process not Found
5736	Process not Found
5760	Process not Found
1500	Process not Found
3080	Process not Found
4336	Process not Found
1152	Process not Found
5652	Process not Found
3984	Process not Found
4472	Process not Found
4568	Process not Found
4376	Process not Found
3044	Process not Found
5280	Process not Found
4612	Process not Found
5132	Process not Found
3392	Process not Found
5996	Process not Found
1272	Process not Found
5448	Process not Found
1704	Process not Found
2772	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
536	CMD.exe
1276	CMD.exe
5076	CMD.exe
680	CMD.exe
1564	CMD.exe
332	CMD.exe
5432	CMD.exe
4856	CMD.exe
4144	CMD.exe
1860	CMD.exe
5172	CMD.exe
5864	CMD.exe
3124	CMD.exe
2832	CMD.exe
2396	CMD.exe
4420	CMD.exe
6124	CMD.exe
3512	CMD.exe
3632	CMD.exe
1120	CMD.exe
1432	CMD.exe
5296	CMD.exe
2712	CMD.exe
1108	CMD.exe
5000	CMD.exe
4412	CMD.exe
1452	CMD.exe
2404	CMD.exe
4740	CMD.exe
776	CMD.exe
5080	CMD.exe
2436	CMD.exe
888	CMD.exe
4728	CMD.exe
3216	CMD.exe
4300	CMD.exe
1684	CMD.exe
4336	CMD.exe
4504	CMD.exe
620	CMD.exe
4180	CMD.exe
3380	CMD.exe
5300	CMD.exe
3464	CMD.exe
4176	CMD.exe
2780	CMD.exe
2356	CMD.exe
2160	CMD.exe
4640	CMD.exe
5352	CMD.exe
1004	CMD.exe
4908	CMD.exe
3572	CMD.exe
4764	CMD.exe
6104	CMD.exe
5700	CMD.exe
4720	CMD.exe
1236	CMD.exe
2752	CMD.exe
5020	CMD.exe
5244	CMD.exe
4876	CMD.exe
2776	CMD.exe
5364	CMD.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Wireshark Host.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Wireshark Host.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Wireshark Host.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4160	schtasks.exe
624	schtasks.exe
3592	schtasks.exe
1932	schtasks.exe
3880	schtasks.exe
1976	schtasks.exe
3044	schtasks.exe
2784	schtasks.exe
212	schtasks.exe
5088	schtasks.exe
5864	schtasks.exe
5304	schtasks.exe
3984	schtasks.exe
3024	schtasks.exe
2960	schtasks.exe
3376	schtasks.exe
2356	schtasks.exe
3372	schtasks.exe
116	schtasks.exe
2720	schtasks.exe
6108	schtasks.exe
4616	schtasks.exe
5356	schtasks.exe
2908	schtasks.exe
4388	schtasks.exe
556	schtasks.exe
3676	schtasks.exe
1272	schtasks.exe
5388	schtasks.exe
4016	schtasks.exe
448	schtasks.exe
1156	schtasks.exe
968	schtasks.exe
4448	schtasks.exe
4024	schtasks.exe
468	schtasks.exe
1556	schtasks.exe
5668	schtasks.exe
5308	schtasks.exe
4696	schtasks.exe
3460	schtasks.exe
5232	schtasks.exe
3000	schtasks.exe
5600	schtasks.exe
5328	schtasks.exe
6076	schtasks.exe
4112	schtasks.exe
6004	schtasks.exe
3632	schtasks.exe
4536	schtasks.exe
4316	schtasks.exe
1104	schtasks.exe
4888	schtasks.exe
5552	schtasks.exe
1108	schtasks.exe
2188	schtasks.exe
5900	schtasks.exe
1784	schtasks.exe
2432	schtasks.exe
3044	schtasks.exe
5968	schtasks.exe
4516	schtasks.exe
5424	schtasks.exe
5032	schtasks.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
3048	MATLAB.exe
3048	MATLAB.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
5084	Wireshark Host.exe
4568	MATLAB.exe
4568	MATLAB.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
5896	Wireshark Host.exe
1636	MATLAB.exe
1636	MATLAB.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
4236	Wireshark Host.exe
5100	MATLAB.exe
5100	MATLAB.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4128	Client.exe
Token: SeDebugPrivilege	3048	MATLAB.exe
Token: SeDebugPrivilege	5084	Wireshark Host.exe
Token: SeDebugPrivilege	4568	MATLAB.exe
Token: SeDebugPrivilege	5896	Wireshark Host.exe
Token: SeDebugPrivilege	1636	MATLAB.exe
Token: SeDebugPrivilege	4236	Wireshark Host.exe
Token: SeDebugPrivilege	5100	MATLAB.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 5912	4128	Client.exe	90
PID 5912 wrote to memory of 620	5912	CMD.exe	92
PID 4128 wrote to memory of 4564	4128	Client.exe	93
PID 4564 wrote to memory of 4328	4564	CMD.exe	95
PID 4128 wrote to memory of 4540	4128	Client.exe	96
PID 4540 wrote to memory of 1484	4540	CMD.exe	98
PID 4128 wrote to memory of 2508	4128	Client.exe	102
PID 2508 wrote to memory of 1224	2508	CMD.exe	104
PID 4128 wrote to memory of 2816	4128	Client.exe	105
PID 2816 wrote to memory of 5196	2816	CMD.exe	107
PID 4128 wrote to memory of 532	4128	Client.exe	108
PID 532 wrote to memory of 3000	532	CMD.exe	110
PID 4128 wrote to memory of 2064	4128	Client.exe	112
PID 2064 wrote to memory of 556	2064	CMD.exe	114
PID 4128 wrote to memory of 5572	4128	Client.exe	115
PID 5572 wrote to memory of 1772	5572	CMD.exe	117
PID 3048 wrote to memory of 4764	3048	MATLAB.exe	118
PID 4764 wrote to memory of 3992	4764	CMD.exe	120
PID 4128 wrote to memory of 3140	4128	Client.exe	121
PID 3140 wrote to memory of 2832	3140	CMD.exe	123
PID 3048 wrote to memory of 5012	3048	MATLAB.exe	124
PID 5012 wrote to memory of 5596	5012	CMD.exe	126
PID 4128 wrote to memory of 6104	4128	Client.exe	127
PID 6104 wrote to memory of 5284	6104	CMD.exe	129
PID 4128 wrote to memory of 340	4128	Client.exe	130
PID 340 wrote to memory of 3480	340	CMD.exe	132
PID 4128 wrote to memory of 5460	4128	Client.exe	133
PID 5460 wrote to memory of 1244	5460	CMD.exe	135
PID 4128 wrote to memory of 1584	4128	Client.exe	137
PID 1584 wrote to memory of 2008	1584	CMD.exe	139
PID 4128 wrote to memory of 4344	4128	Client.exe	140
PID 4344 wrote to memory of 5864	4344	CMD.exe	142
PID 4128 wrote to memory of 5332	4128	Client.exe	145
PID 5332 wrote to memory of 5396	5332	CMD.exe	147
PID 4128 wrote to memory of 5804	4128	Client.exe	148
PID 5804 wrote to memory of 4472	5804	CMD.exe	150
PID 4128 wrote to memory of 4052	4128	Client.exe	151
PID 4052 wrote to memory of 4352	4052	CMD.exe	153
PID 4128 wrote to memory of 2904	4128	Client.exe	154
PID 2904 wrote to memory of 1688	2904	CMD.exe	156
PID 4128 wrote to memory of 2468	4128	Client.exe	157
PID 2468 wrote to memory of 2720	2468	CMD.exe	159
PID 4128 wrote to memory of 4928	4128	Client.exe	160
PID 4928 wrote to memory of 2496	4928	CMD.exe	162
PID 4128 wrote to memory of 2712	4128	Client.exe	163
PID 2712 wrote to memory of 1348	2712	CMD.exe	165
PID 4128 wrote to memory of 4964	4128	Client.exe	168
PID 4964 wrote to memory of 5324	4964	CMD.exe	170
PID 4128 wrote to memory of 1280	4128	Client.exe	171
PID 1280 wrote to memory of 5440	1280	CMD.exe	173
PID 4128 wrote to memory of 5712	4128	Client.exe	174
PID 5712 wrote to memory of 5796	5712	CMD.exe	176
PID 4128 wrote to memory of 1136	4128	Client.exe	177
PID 1136 wrote to memory of 4888	1136	CMD.exe	179
PID 4128 wrote to memory of 4216	4128	Client.exe	180
PID 4216 wrote to memory of 4276	4216	CMD.exe	182
PID 4128 wrote to memory of 5976	4128	Client.exe	183
PID 5976 wrote to memory of 6108	5976	CMD.exe	185
PID 4128 wrote to memory of 2928	4128	Client.exe	186
PID 2928 wrote to memory of 3880	2928	CMD.exe	188
PID 4128 wrote to memory of 2436	4128	Client.exe	189
PID 2436 wrote to memory of 1668	2436	CMD.exe	191
PID 4128 wrote to memory of 5416	4128	Client.exe	192
PID 5416 wrote to memory of 5236	5416	CMD.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\Documents\MATLAB.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Unity" /tr "C:\Users\Admin\Documents\MATLAB.exe"
    3⤵
    PID:620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe" /RL HIGHEST
    3⤵
    PID:1484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2832
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2008
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2496
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:308
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:940
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:6124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3344
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1244
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5864
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4148
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1976
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4672
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2068
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4740
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1904
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3948
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3916
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5304
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5700
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5676
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1556
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1724
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3680
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3500
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3952
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4608
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4512
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4616
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2456
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5936
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4796
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3584
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3956
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5652
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4960
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2396
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1716
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1272
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1684
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1480
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4876
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2852
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3380
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5636
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5220
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5600
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3192
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3632
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5400
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6084
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4624
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2480
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4064
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4336
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5300
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2176
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4384
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5352
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5744
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5040
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3348
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4028
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3060
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5424
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5364
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1644
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4836
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2252
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1236
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3632
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5284
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5380
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3248
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4484
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3688
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1196
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5384
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4376
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4260
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5116
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:916
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5328
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2780
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:640
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4604
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3572
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5560
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6108
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4416
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4024
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4508
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5168
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:212
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5468
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3592
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:880
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:888
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5172
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2276
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2152
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1432
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4884
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4800
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5396
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4576
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1044
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4432
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1980
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4740
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:776
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1440
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5900
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4852
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4388
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5440
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:448
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3492
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3860
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4280
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5456
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3312
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2232
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4132
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:452
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5004
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4620
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:620
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2584
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1488
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3784
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5972
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:6132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3988
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2820
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5172
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:320
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2240
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:468
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4668
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:924
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2788
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5748
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2412
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3800
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5316
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5144
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3080
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4756
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2980
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4904
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5296
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1932
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2688
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1292
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5100
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4444
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2808
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:176
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:3216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4184
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:4180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3500
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5580
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5152
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3836
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:332
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4212
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5536
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3056
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3636
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:116
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:6140
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3848
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2308
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3856
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1016
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4112
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:2356
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:2576
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4228
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:1824
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:5556
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5180
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3984
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4376
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1120
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:552
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:4752
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:928
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:1780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4428
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5768
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:3096
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2184
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:1108
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5456

C:\Users\Admin\Documents\MATLAB.exe
C:\Users\Admin\Documents\MATLAB.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:3992
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5596

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5084
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:4976
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    PID:5384
- C:\Users\Admin\Documents\MATLAB.exe
  "C:\Users\Admin\Documents\MATLAB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4568
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:4420
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      PID:640
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    PID:5324
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      PID:836

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5896
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  PID:2564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4016
- C:\Users\Admin\Documents\MATLAB.exe
  "C:\Users\Admin\Documents\MATLAB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    - Executes a command shell one-liner
    PID:1860
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      PID:3964
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    PID:4948
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      PID:3396

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\Wireshark Host.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  PID:5352
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1932
- C:\Users\Admin\Documents\MATLAB.exe
  "C:\Users\Admin\Documents\MATLAB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST & exit
    3⤵
    PID:6000
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "HandBrake" /tr "C:\Users\Admin\Documents\MATLAB.exe" /RL HIGHEST
      4⤵
      PID:1164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-0-0x00000000002A0000-0x00000000002F6000-memory.dmp

Download

memory/4128-32-0x000000001B670000-0x000000001B680000-memory.dmp

Download

memory/4128-82-0x000000001B670000-0x000000001B680000-memory.dmp

Download