cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services64" /tr '"C:\Users\test22\AppData\Roaming\Services64.exe"' & exit
6012schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Services64" /tr '"C:\Users\test22\AppData\Roaming\Services64.exe"'
4980sihost32.exe "C:\Users\test22\AppData\Roaming\Microsoft\inc\sihost32.exe"
4848cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Services64" /tr '"C:\Users\test22\AppData\Roaming\Services64.exe"' & exit
7932schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "Services64" /tr '"C:\Users\test22\AppData\Roaming\Services64.exe"'
3944sihost32.exe "C:\Users\test22\AppData\Roaming\Microsoft\inc\sihost32.exe"
1904