wscript.exe "C:\Windows\System32\WScript.exe" "C:\FontWinintohostNet\UWE3BhTNVatEksTFn0CppPafAWK.vbe"
8564schtasks.exe "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\AxInstSv\SearchFilterHost.exe'" /rl HIGHEST /f
5752schtasks.exe "schtasks" /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\Documents and Settings\SearchIndexer.exe'" /rl HIGHEST /f
5260schtasks.exe "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\WmiPrvSE.exe'" /rl HIGHEST /f
6844schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
8628schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\LICENSE\pw.exe'" /rl HIGHEST /f
7672schtasks.exe "schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons0026\taskhost.exe'" /rl HIGHEST /f
4104schtasks.exe "schtasks" /create /tn "srvany" /sc ONLOGON /tr "'C:\Windows\SysWOW64\mf3216\srvany.exe'" /rl HIGHEST /f
7000schtasks.exe "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default User\sppsvc.exe'" /rl HIGHEST /f
6652schtasks.exe "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
4804