644c4dc6bac9156546cca54ce95fa22e5b7df08de5571784085f095a96494a55.exe "C:\Users\test22\AppData\Local\Temp\644c4dc6bac9156546cca54ce95fa22e5b7df08de5571784085f095a96494a55.exe"
2652cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "crsi" /tr '"C:\Users\test22\AppData\Roaming\crsi.exe"' & exit
1216schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "crsi" /tr '"C:\Users\test22\AppData\Roaming\crsi.exe"'
2064timeout.exe timeout 3
320crsi.exe "C:\Users\test22\AppData\Roaming\crsi.exe"
2444