wscript.exe "C:\Windows\System32\WScript.exe" "C:\FontWinintohostNet\UWE3BhTNVatEksTFn0CppPafAWK.vbe"
7948schtasks.exe "schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\WmiPrvSE.exe'" /rl HIGHEST /f
4220schtasks.exe "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\tmpzdcjvb\bin\wininit.exe'" /rl HIGHEST /f
1812schtasks.exe "schtasks" /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\SysWOW64\osk\cmd.exe'" /rl HIGHEST /f
8408schtasks.exe "schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Sandbox\test22\DefaultBox\user\all\Microsoft\Windows\Caches\csrss.exe'" /rl HIGHEST /f
1036schtasks.exe "schtasks" /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\SearchIndexer.exe'" /rl HIGHEST /f
5860chcp.com chcp 65001
3944PING.EXE ping -n 5 localhost
8700SearchIndexer.exe "C:\Recovery\ab7d780a-0706-11e8-9512-b992fd7a33be\SearchIndexer.exe"
3460