brokerhostperffontSavesdhcp.exe "C:\Users\test22\AppData\Local\Temp\brokerhostperffontSavesdhcp.exe"
1080schtasks.exe "schtasks" /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\FXSMON\winlogon.exe'" /rl HIGHEST /f
2760schtasks.exe "schtasks" /create /tn "lsm" /sc ONLOGON /tr "'C:\Windows\System32\DShowRdpFilter\lsm.exe'" /rl HIGHEST /f
2840schtasks.exe "schtasks" /create /tn "smss" /sc ONLOGON /tr "'C:\Documents and Settings\smss.exe'" /rl HIGHEST /f
1188schtasks.exe "schtasks" /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\msihnd\wininit.exe'" /rl HIGHEST /f
2984schtasks.exe "schtasks" /create /tn "pw" /sc ONLOGON /tr "'C:\Python27\README\pw.exe'" /rl HIGHEST /f
2740smss.exe "C:\Documents and Settings\smss.exe"
1852