schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Users\Default User\pw.exe'" /rl HIGHEST /f
620schtasks.exe "schtasks" /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons004a\SearchFilterHost.exe'" /rl HIGHEST /f
260schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\pw.exe'" /rl HIGHEST /f
1772schtasks.exe "schtasks" /create /tn "SearchProtocolHost" /sc ONLOGON /tr "'C:\Windows\System32\nrpsrv\SearchProtocolHost.exe'" /rl HIGHEST /f
2728schtasks.exe "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Tasks\sppsvc.exe'" /rl HIGHEST /f
1408powershell.exe "powershell" Get-MpPreference -verbose
2552