cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\test22\AppData\Local\Temp\services32.exe"' & exit
1204schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\test22\AppData\Local\Temp\services32.exe"'
2532cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\test22\AppData\Local\Temp\services32.exe"' & exit
1908schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\test22\AppData\Local\Temp\services32.exe"'
2080sihost32.exe "C:\Users\test22\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
2668