server1.exe "C:\Users\test22\AppData\Local\Temp\server1.exe"
1440schtasks.exe "schtasks" /create /tn "fim" /sc ONLOGON /tr "C:\Users\test22\AppData\Local\Temp\server1.exe" /rl HIGHEST /f
2840fim.exe "C:\Users\test22\AppData\Roaming\frm\fim.exe"
2900schtasks.exe "schtasks" /create /tn "fim" /sc ONLOGON /tr "C:\Users\test22\AppData\Roaming\frm\fim.exe" /rl HIGHEST /f
1668